Public PoC Exploit Exposes CVE-2026-44421 FreeRDP Heap Buffer Overflow to Remote Code Execution
Do Son 
FreeRDP developers recently patched a critical flaw affecting numerous workstations worldwide. Security researchers publicly disclosed the details and the proof-of-concept exploit code for this FreeRDP heap buffer overflow. Consequently, attackers can study this working exploit to compromise vulnerable systems.
TL;DR
A critical heap buffer overflow vulnerability exists in the FreeRDP Windows client virtual channel. A malicious server can execute arbitrary code on a connecting client. Proof-of-concept exploit code is now publicly available, increasing the immediate danger to users.
Why It Matters
FreeRDP provides the core remote access engine for millions of servers and enterprise tools. A malicious actor can compromise a client device simply by having the victim connect and paste files. The public release of working exploit code drastically lowers the barrier to entry for attackers. Therefore, organizations must act quickly. Related flaws like CVE-2026-44422 and CVE-2026-40033 show similar risks in the protocol implementation. Experts estimate this issue threatens thousands of active daily users depending on the unmaintained Windows client.
How the Attack Works
The vulnerability resides in the clipboard static virtual channel. First, the client requests file contents from the server. The server responds with a data payload much larger than requested. The protocol parser computes the copy size without any upper bound validation. Finally, the system executes a copy function using the server-controlled size. This action writes data past the allocated destination bounds, causing a FreeRDP heap buffer overflow. Overwriting adjacent heap objects enables attackers to hijack the control flow. Ultimately, this mechanism grants remote code execution to the attacker.
Affected Versions
This flaw impacts the FreeRDP Windows client versions 3.28.0 and older. The issue specifically targets the wfreerdp component. Maintainers note that this specific component remains unmaintained.
Patch or Mitigation Steps
Users must immediately stop using the vulnerable wfreerdp client. The development team completely removed this component from recent nightly builds. Furthermore, administrators should review the official FreeRDP security advisory for detailed technical context. You can download the secure 3.29.0 version from the FreeRDP releases page. Update your remote access tools today to block this exploit.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
