AIKIDO-2026-555575

TL;DR

The Windows client exposes clipboard file contents to OLE paste consumers through a COM IStream, and CliprdrStream_Read copies the server's file-contents response into the caller buffer using the server-supplied length instead of the caller-provided buffer size. A malicious or compromised RDP server can answer a bounded request with an oversized response, overflowing a fixed-size heap buffer in the paste-consuming process with attacker-controlled bytes. This is a server-controlled heap out-of-bounds write. The fix clamps the copy to the caller buffer size and reports only what fits.