# Critical FreeRDP Clipboard Virtual Channel Heap Buffer Overflow (GHSA-cj9v-h4hq-29jr, CVSS 9.4)

> A critical heap buffer overflow (CVSS 9.4, CVSS 4.0 vector) exists in the FreeRDP Windows client (wfreerdp) clipboard redirection (CLIPRDR) virtual channel. A malicious RDP server can send an oversized CLIPRDR_FILECONTENTS_RESPONSE with a server-controlled length value that is used unchecked in a CopyMemory operation, corrupting heap memory and potentially enabling remote code execution when a victim connects and performs a clipboard paste. No CVE has been assigned as of analysis; affects FreeRDP <= 3.28.0, fixed in 3.29.0.

- **Published:** 2026-07-25T00:00:00Z
- **Last reviewed:** 2026-07-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1689
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-freerdp-cliprdr-heap-overflow-tl-2026-1689.webp?v=7bcf29dc (Threadlinqs threat intel: GHSA-cj9v-h4hq-29jr FreeRDP Overflow: Detection & IOCs (TL-2026-1689) — Critical severity, 18 IOCs, 9 detection rules.)
- **ID:** TL-2026-1689
- **Severity:** CRITICAL (CVSS 9.4)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 18

## Description

FreeRDP's Windows client (wfreerdp) contains a heap-based buffer overflow (CWE-122) in its clipboard redirection (CLIPRDR) virtual-channel handling, disclosed by FreeRDP maintainers as GHSA-cj9v-h4hq-29jr and credited to Tencent Yunding Security Lab (discoverer 'cbcs', reported by 'hyperlyz'). The flaw sits in the file-contents-response path: when the client requests a chunk of clipboard file data from an RDP server, the server's CLIPRDR_FILECONTENTS_RESPONSE reply carries a length field (cbRequested/dataLen) that is attacker-controlled. The vulnerable call chain is cliprdr_read_file_contents_response() (channels/cliprdr/cliprdr_common.c), which extracts the server-supplied length without validating it against the client's original request size, followed by wf_cliprdr_server_file_contents_response() (client/Windows/wf_cliprdr.c), which stores the oversized value, and finally CliprdrStream_Read(), which performs a CopyMemory() using that unvalidated length into a fixed/undersized destination buffer. Public write-ups describe cbRequested being manipulated up to 65,536 bytes, so a client that requested 16 KB and receives a crafted 64 KB response can have roughly 48 KB written past the intended heap allocation.

Exploitation requires a victim's wfreerdp client to connect to an attacker-controlled or attacker-compromised RDP server with clipboard redirection enabled (the Windows default) and to perform a clipboard paste operation (e.g., Ctrl+V in Explorer) that triggers a file-contents request/response exchange. Consequences documented across sources range from an immediate process crash (SIGSEGV) to heap metadata corruption affecting adjacent allocations and, under favorable heap layout/allocator conditions, control-flow hijacking and remote code execution in the context of the connecting user.

As of publication no CVE identifier has been assigned to GHSA-cj9v-h4hq-29jr, no public proof-of-concept exploit has been released, and no in-the-wild exploitation has been reported. The advisory was published alongside FreeRDP 3.29.0 (released 2026-07-13) as part of a coordinated batch of 22 security advisories from multiple independent researchers (Bin Luo/UESTC, Team Atlanta, @canomer, @HEXER365, and Tencent Yunding Security Lab). Notably, the FreeRDP maintainers state in the advisory that wfreerdp itself "is unmaintained and should not be used" and has been removed from nightly builds, making migration off the component — not just patching — the recommended long-term remediation.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1584.004 Server
- T1583.003 Virtual Private Server
- T1608 Stage Capabilities
- T1199 Trusted Relationship
- T1566 Phishing
- T1133 External Remote Services
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1684.001 Impersonation
- T1021.001 Remote Desktop Protocol
- T1115 Clipboard Data
- T1499.004 Application or System Exploitation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**FreeRDP CLIPRDR Oversized File-Contents-Response Correlated with wfreerdp Crash — Exploitation (SPL)** (`TL-2026-1689-SPL-001`)

Detects the core exploitation pattern for GHSA-cj9v-h4hq-29jr: an RDP CLIPRDR_FILECONTENTS_RESPONSE PDU whose server-supplied cbRequested/dataLen field substantially exceeds the client's own file-contents-request size, correlated with a wfreerdp.exe access-violation (0xc0000005) crash on the same host shortly afterward. This is the network+host correlation of the unvalidated-length heap overflow in cliprdr_read_file_contents_response()/CliprdrStream_Read().

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1204, T1115, T1499.004
- **Data sources:** sysmon, windows_security, wineventlog_application, rdp_proxy_network_sensor
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=network sourcetype="rdp:cliprdr_virtual_channel" pdu_type="CLIPRDR_FILECONTENTS_RESPONSE"
| eval overflow_bytes=cbRequested-client_requested_len
| where overflow_bytes>0
| eval pdu_time=_time
| join type=left host [
    search index=wineventlog sourcetype="WinEventLog:Application" EventCode=1000 ProcessName="wfreerdp.exe" ExceptionCode="0xc0000005"
    | eval crash_time=_time
    | fields host, user, ProcessName, FaultingModule, crash_time
]
| eval correlated_crash=if(isnotnull(crash_time) AND (crash_time-pdu_time)>=0 AND (crash_time-pdu_time)<=30, "yes", "no")
| where overflow_bytes>16384 OR correlated_crash="yes"
| table _time host user ProcessName client_requested_len cbRequested overflow_bytes crash_time correlated_crash FaultingModule server_ip
| sort -_time
```

### Microsoft KQL

```kql
let LookbackWindow = 24h;
let CliprdrPdus = RdpCliprdrEvents_CL
| where TimeGenerated > ago(LookbackWindow)
| where PduType_s == "CLIPRDR_FILECONTENTS_RESPONSE"
| extend OverflowBytes = toint(ServerClaimedLen_d) - toint(ClientRequestedLen_d)
| where OverflowBytes > 0
| project TimeGenerated, DeviceName = DeviceName_s, RemoteIP = RemoteIP_s, ClientRequestedLen = toint(ClientRequestedLen_d), ServerClaimedLen = toint(ServerClaimedLen_d), OverflowBytes;
let WfreerdpCrashes = Event
| where TimeGenerated > ago(LookbackWindow)
| where EventLog == "Application" and Source == "Application Error" and EventID == 1000
| where RenderedDescription has "wfreerdp.exe" and RenderedDescription has "0xc0000005"
| project CrashTime = TimeGenerated, DeviceName = Computer;
CliprdrPdus
| join kind=leftouter WfreerdpCrashes on DeviceName
| extend CorrelatedCrash = iff(isnotempty(CrashTime) and CrashTime between (TimeGenerated .. TimeGenerated + 30s), "yes", "no")
| where OverflowBytes > 16384 or CorrelatedCrash == "yes"
| project TimeGenerated, DeviceName, RemoteIP, ClientRequestedLen, ServerClaimedLen, OverflowBytes, CorrelatedCrash
| sort by TimeGenerated desc
```

### Sigma

```yaml
title: FreeRDP wfreerdp Crash Following Oversized CLIPRDR File-Contents-Response (GHSA-cj9v-h4hq-29jr Exploitation Attempt)
id: 8f1c3a2e-1689-4a1e-9b1a-tl16891exp01
status: experimental
description: Detects wfreerdp.exe terminating with an access-violation (0xc0000005) fault immediately following a clipboard file-contents exchange, consistent with exploitation of the CLIPRDR_FILECONTENTS_RESPONSE heap buffer overflow (GHSA-cj9v-h4hq-29jr, CVSS 9.4, CWE-122).
references:
    - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cj9v-h4hq-29jr
    - https://gbhackers.com/critical-freerdp-clipboard-flaw/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-25
tags:
    - attack.execution
    - attack.t1203
    - attack.t1204
    - attack.collection
    - attack.t1115
    - attack.impact
    - attack.t1499.004
    - cve.ghsa-cj9v-h4hq-29jr
logsource:
    product: windows
    service: application
    category: application_crash
detection:
    selection:
        Provider: 'Application Error'
        EventID: 1000
        ProcessName|contains: 'wfreerdp.exe'
        ExceptionCode: '0xc0000005'
    condition: selection
falsepositives:
    - Unrelated wfreerdp crashes caused by memory pressure or unrelated bugs unconnected to a CLIPRDR exchange
    - Crashes on FreeRDP 3.29.0+ (patched) triggered by unrelated defects
level: high
```

**Known false positives:**

- Unrelated wfreerdp crashes from memory pressure or unrelated bugs unconnected to a CLIPRDR exchange
- Crashes on FreeRDP 3.29.0+ (patched) triggered by unrelated defects

**Tuning notes:** Tune the overflow_bytes threshold (default: flag PDUs where the server-claimed length exceeds 2x the client's request, or any value beyond 16 KB) to the environment's typical CLIPRDR transfer sizes; extend the crash-correlation window if network sensor and endpoint clocks are not tightly synced (NTP drift).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- [indicator] CLIPRDR Oversized File-Contents-Response Correlated with wfreerdp Crash — Exploitation (KQL) (locked: unlock with TL Creds)
- Anomalous Child Process from [indicator] Near Crash Window — Post-Exploitation (KQL) (locked: unlock with TL Creds)
- Outbound RDP to Untrusted External Server with Multi-Host wfreerdp Crash Spread — C2/Lateral Movement (KQL) (locked: unlock with TL Creds)
- [indicator] CLIPRDR Oversized File-Contents-Response Correlated with wfreerdp Crash — Exploitation (Sigma) (locked: unlock with TL Creds)
- Anomalous Child Process from [indicator] Near Crash Window — Post-Exploitation (Sigma) (locked: unlock with TL Creds)
- Outbound RDP to Untrusted External Server with Multi-Host wfreerdp Crash Spread — C2/Lateral Movement (Sigma) (locked: unlock with TL Creds)
- Anomalous Child Process from [indicator] Near Crash Window — Post-Exploitation (SPL) (locked: unlock with TL Creds)
- Outbound RDP to Untrusted External Server with Multi-Host wfreerdp Crash Spread — C2/Lateral Movement (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [GBHackers: Critical FreeRDP Clipboard Flaw Could Let Malicious RDP Servers Execute Code](https://gbhackers.com/critical-freerdp-clipboard-flaw/)
- [FreeRDP/FreeRDP GitHub Security Advisory GHSA-cj9v-h4hq-29jr: Windows Client Cliprdr Virtual Channel Heap Buffer Overflow](https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cj9v-h4hq-29jr)
- [CyberPress: Critical FreeRDP Clipboard Flaw Could Let Malicious RDP Servers Execute Code](https://cyberpress.org/critical-freerdp-clipboard-flaw/)
- [FreeRDP 3.29.0 official release announcement](https://www.freerdp.com/2026/07/13/3_29_0-release)
- [Help Net Security: FreeRDP 3.29.0 security update resolves 22 advisories](https://www.helpnetsecurity.com/2026/07/15/freerdp-3-29-0-security-update/)
- [Linuxiac: FreeRDP 3.29 Is Out With Extensive Security Fixes](https://linuxiac.com/freerdp-3-29-is-out-with-extensive-security-fixes/)
- [news4hackers: FreeRDP 3.29.0 Security Update Fixes 22 Critical Vulnerabilities](https://www.news4hackers.com/freerdp-3-29-0-security-update-fixes-22-critical-vulnerabilities/)
- [GitHub Release: FreeRDP 3.29.0 (tag)](https://github.com/FreeRDP/FreeRDP/releases/tag/3.29.0)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1689