Vulnerabilities

FreeRDP's Windows client before 3.29.0 contains a heap-based buffer overflow (CWE-122) in the clipboard virtual channel, where a CLIPRDR_FILE_CONTENTS_RESPONSE PDU is processed without validating the server-provided size against the destination buffer. The flaw is triggered when a user connects to a malicious or compromised RDP server and then performs a paste operation, at which point the server sends a data payload significantly larger than the client requested. The resulting heap memory corruption can allow the attacker to achieve remote code execution on the user's Windows workstation. Anyone running an affected FreeRDP Windows client version who connects to RDP servers they do not fully trust is exposed, since the CVSS 4.0 vector reflects network reachability with user interaction (the paste) but no privileges. Exploitation has not been reported in the wild; one public proof-of-concept advisory exists and EPSS currently assigns a low 0.5% probability of exploitation in the next 30 days.

Do: Upgrade the FreeRDP Windows client to version 3.29.0 or later, which fixes the missing size validation in the clipboard virtual channel. Until patched, instruct users to avoid paste operations when connected to untrusted or potentially compromised RDP servers, and inventory endpoints for FreeRDP client installations to confirm they are on a fixed version.

FreeRDP before 3.28.0 (affected out_length, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an unauthenticated attacker can forge a ciphertext whose decrypted value is up to the full modulus length (e.g. 256 bytes for RSA-2048), overflowing the 32-byte heap buffer by up to ~224 attacker-controlled bytes pre-authentication, resulting in denial of service.