CVE-2026-111376

A moderate-severity heap out-of-bounds read flaw was found in FreeRDP's Windows client clipboard file transfer handling (CliprdrStream_New). When a user pastes or opens a remote file offered through the clipboard by a malicious RDP server, the server can answer the client's FILECONTENTS_SIZE request with a response shorter than the required eight bytes; the client allocates only that shorter buffer but still dereferences it as an eight-byte value, reading beyond the end of the heap allocation. This can terminate the client application (denial of service) or leave an invalid internal stream size that corrupts the clipboard file transfer. The over-read is bounded to a few bytes of adjacent heap memory, and the upstream advisory does not establish code execution, session hijacking, or an authentication bypass. Exploitation requires a user to connect to an attacker-controlled RDP server and then paste or open a remote clipboard file. Red Hat rates this flaw Moderate impact (CVSS 3.1: 5.0, AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L), while the upstream CVSS 4.0 score is 2.3 (Low); the difference stems primarily from CVSS version metric changes rather than a substantive disagreement about the vulnerability. The freerdp and freerdp2 packages are recorded as affected across Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and Fedora/EPEL community streams. Fixes for the affected Red Hat streams are currently deferred; until a fixed package is released, the residual risk is a client-side crash or corrupted clipboard file transfer when users connect to untrusted RDP servers.