CVE-2026-109248 FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via WinPR Clipboard cFileName

FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convertfiledescriptorstofilelist, which scans a server-controlled FILEDESCRIPTORW cFileName with unbounded wcschr and countspecialchars calls without a NUL-termination guarantee. A malicious RDP server...