Vulnerabilities

FreeRDP 3.0.0 through 3.30.0 leak uninitialized heap memory to RDP peers because the Save Session Info PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) skip reserved padding bytes with Stream_Seek instead of zeroing them with Stream_Zero, leaving up to 576 bytes of stale heap content in each outgoing PDU (CWE-908, missing initialization). The flaw is triggered when a FreeRDP-based server that calls rdpUpdate::SaveSessionInfo - or freerdp-proxy, which forwards these PDUs - sends the logon-info message over a malloc-allocated (not zeroed) send buffer, so previously freed heap contents are transmitted to the receiving client. A connecting RDP client can therefore read residual server or proxy process memory, potentially including cleartext credentials from earlier sessions handled by the same process. Any FreeRDP 3.x-based RDP server or RDP proxy deployment is affected; the issue is fixed in FreeRDP 3.31.0. No exploitation in the wild is currently known (not in CISA KEV, EPSS about 0.4%), and one public advisory (GHSA-v649-94v2-p72q) is available.

Do: Upgrade FreeRDP to 3.31.0 or later on all server-side components (FreeRDP-based RDP servers and freerdp-proxy deployments), as versions 3.0.0 through 3.30.0 are affected. Because the leaked heap data may contain cleartext credentials from prior sessions, rotate credentials used through affected servers/proxies after patching and restrict which clients can connect to FreeRDP-based RDP endpoints. Audit installed FreeRDP 3.x versions in your estate and track the vendor advisory GHSA-v649-94v2-p72q for updates.

FreeRDP's Windows client before 3.29.0 contains a heap-based buffer overflow (CWE-122) in the clipboard virtual channel, where a CLIPRDR_FILE_CONTENTS_RESPONSE PDU is processed without validating the server-provided size against the destination buffer. The flaw is triggered when a user connects to a malicious or compromised RDP server and then performs a paste operation, at which point the server sends a data payload significantly larger than the client requested. The resulting heap memory corruption can allow the attacker to achieve remote code execution on the user's Windows workstation. Anyone running an affected FreeRDP Windows client version who connects to RDP servers they do not fully trust is exposed, since the CVSS 4.0 vector reflects network reachability with user interaction (the paste) but no privileges. Exploitation has not been reported in the wild; one public proof-of-concept advisory exists and EPSS currently assigns a low 0.5% probability of exploitation in the next 30 days.

Do: Upgrade the FreeRDP Windows client to version 3.29.0 or later, which fixes the missing size validation in the clipboard virtual channel. Until patched, instruct users to avoid paste operations when connected to untrusted or potentially compromised RDP servers, and inventory endpoints for FreeRDP client installations to confirm they are on a fixed version.

FreeRDP before 3.28.0 (affected out_length, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an unauthenticated attacker can forge a ciphertext whose decrypted value is up to the full modulus length (e.g. 256 bytes for RSA-2048), overflowing the 32-byte heap buffer by up to ~224 attacker-controlled bytes pre-authentication, resulting in denial of service.

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched with the non-default /cache:codec:rfx option pass desktop stride and height to RemoteFX decoding for Cache Bitmap V3 data while allocating bitmap->data only for the smaller DstWidth and DstHeight in gdi_Bitmap_Decompress, allowing a malicious RDP server to trigger a heap out-of-bounds write with attacker-controlled offset and content. This issue is fixed in version 3.27.1.

FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial of service.

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in FreeRDP's server-side clipboard (cliprdr) channel by sending a CB_CLIP_CAPS PDU with a too-small capabilitySetLength. This can crash the server process (remote DoS) and may be exploitable for code execution because it corrupts heap memory. This vulnerability is fixed in 3.26.0.

FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers to write out-of-bounds heap memory. The vulnerability occurs because rectangle validation clamps coordinates to UINT16_MAX but performs copy operations using unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out-of-bounds writes and potentially achieve remote code execution or client crash.

FreeRDP is a free implementation of the Remote Desktop Protocol. Versions prior to 3.25.0 have an off-by-one in the path traversal filter in `channels/drive/client/drive_file.c`. The `contains_dotdot()` function catches `../` and `..\` mid-path but misses `..` when it's the last component with no trailing separator. A rogue RDP server can read, list, or write files one directory above the client's shared folder through RDPDR requests. This requires the victim to connect with drive redirection enabled. Version 3.25.0 patches the issue.

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, there is a heap-buffer-overflow READ vulnerability at 24 bytes before the allocation, in winpr_aligned_offset_recalloc(). This issue has been patched in version 3.24.2.

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size > 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0.

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCapacity` can create an endless blocking loop. This may affect all client and server implementations using `FreeRDP`. For practical exploitation this will only work on 32bit systems where the available physical memory is `>= SIZE_MAX`. Version 3.23.0 contains a patch. No known workarounds are available.