Description

RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without an upper bound check. When an OLE paste consumer such as explorer.exe calls IStream::Read with a buffer of cb bytes, CliprdrStream_Read in libs/clipboard/src/windows/wf_cliprdr.c requests that many bytes of a remote file through cliprdr_send_request_filecontents and then executes CopyMemory(pv, clipboard->req_fdata, clipboard->req_fsize), where req_fsize is taken verbatim from the peer's CLIPRDR FileContentsResponse by wf_cliprdr_server_file_contents_response (req_fsize = fileContentsResponse->cbRequested) and is never clamped to cb anywhere in the chain. The function's only length comparison, req_fsize < cb, handles the short-read case and is evaluated after the copy has already occurred. A malicious or compromised peer that answers a small file-contents read with an oversized response therefore writes attacker-chosen data past the end of the paste consumer's heap buffer when the local user pastes clipboard file contents offered by the remote side. The file is a fork of FreeRDP's client/Windows/wf_cliprdr.c, where the same defect is CVE-2026-68579, fixed in FreeRDP 3.30.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-24T14:17:01.550Z",
  "pubdate": "2026-08-24T14:17:01.550Z",
  "executiveSummary": "A heap-based buffer overflow vulnerability exists in the Windows clipboard redirection functionality of RustDesk, stemming from insecure handling of clipboard file contents responses. The flaw is functionally identical to CVE-2026-68579, which affects FreeRDP 3.30.0.\nThe vulnerability allows a malicious or compromised remote peer to trigger memory corruption on a local system when a user attempts to paste clipboard file contents offered by the remote side.\nThe root cause is an absence of an upper bound check when copying peer-supplied data into a fixed-size caller buffer. Specifically, the length parameter provided by the remote peer is trusted implicitly without clamping it to the expected buffer size.\nSuccessful exploitation can result in arbitrary memory overwrite within the heap, potentially leading to application crashes, denial of service, or remote code execution under the context of the paste consumer, such as explorer.exe.\nAttack capabilities require a compromised or malicious remote peer participating in a clipboard redirection session. Exploitation occurs when the local user initiates a paste action involving file contents requested from the attacker.",
  "technicalDetails": "The vulnerability resides in the Windows clipboard redirection implementation located in libs/clipboard/src/windows/wf_cliprdr.c, which is a fork of FreeRDP's client/Windows/wf_cliprdr.c.\nThe vulnerable component is involved in handling clipboard file content transfers during remote sessions via the CLIPRDR protocol. When an OLE paste consumer such as explorer.exe calls IStream::Read with a buffer of cb bytes, the function CliprdrStream_Read requests the corresponding bytes of a remote file through cliprdr_send_request_filecontents.\nThe remote peer responds with a CLIPRDR FileContentsResponse, which is processed by wf_cliprdr_server_file_contents_response. Within this function, req_fsize is assigned directly from fileContentsResponse->cbRequested without verifying if it exceeds the allocated buffer size specified by cb.\nThe core vulnerability is the lack of an upper bound check before memory copying occurs. The function subsequently executes CopyMemory(pv, clipboard->req_fdata, clipboard->req_fsize). The only existing length comparison, req_fsize < cb, is designed to handle short-read scenarios and is evaluated incorrectly after the memory copy operation has already taken place.\nThe step-by-step attack flow proceeds as follows: First, a malicious or compromised peer establishes a session and offers file contents through the clipboard redirection mechanism. Second, the local user interacts with the clipboard and initiates a paste operation for the offered file contents, triggering an OLE paste consumer to invoke IStream::Read. Third, the local system sends a file contents request to the remote peer. Fourth, the malicious peer responds with a maliciously crafted, oversized FileContentsResponse where cbRequested is significantly larger than the caller's buffer cb. Fifth, wf_cliprdr_server_file_contents_response processes the oversized length parameter without validation. Sixth, the CopyMemory function copies the peer-supplied data into the fixed-size caller heap buffer, resulting in a heap buffer overflow that overwrites adjacent memory structures with attacker-controlled data."
}