CVE-2026-109247

3.1Low

Published 12 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

3.1Low

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Required
Impact: Limited impact
Weakness: CWE-22

Impact

A malicious RDP server can read arbitrary local files from the client machine. Exploitation requires a user to connect to the rogue server and perform a clipboard paste operation.

Root cause

The clipboard handler concatenates server-controlled filenames directly into a local file URI without stripping or validating path traversal sequences like '../'.

Affected systems

FreeRDP versions before 3.32.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade to FreeRDP 3.32.0 or newer. If you cannot patch immediately, disable clipboard sharing on RDP client connections.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade freerdp3-x11

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

FreeRDP before 3.32.0 contains a path traversal vulnerability in convert_filedescriptors_to_file_list() in winpr/libwinpr/clipboard/synthetic_file.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or '..' sequences. A malicious RDP server can supply '../' sequences so the user's next clipboard paste copies an arbitrary local file readable by the client user instead of the expected remote file.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109247