Vulnerabilities

FreeRDP 3.0.0 through 3.30.0 leak uninitialized heap memory to RDP peers because the Save Session Info PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) skip reserved padding bytes with Stream_Seek instead of zeroing them with Stream_Zero, leaving up to 576 bytes of stale heap content in each outgoing PDU (CWE-908, missing initialization). The flaw is triggered when a FreeRDP-based server that calls rdpUpdate::SaveSessionInfo - or freerdp-proxy, which forwards these PDUs - sends the logon-info message over a malloc-allocated (not zeroed) send buffer, so previously freed heap contents are transmitted to the receiving client. A connecting RDP client can therefore read residual server or proxy process memory, potentially including cleartext credentials from earlier sessions handled by the same process. Any FreeRDP 3.x-based RDP server or RDP proxy deployment is affected; the issue is fixed in FreeRDP 3.31.0. No exploitation in the wild is currently known (not in CISA KEV, EPSS about 0.4%), and one public advisory (GHSA-v649-94v2-p72q) is available.

Do: Upgrade FreeRDP to 3.31.0 or later on all server-side components (FreeRDP-based RDP servers and freerdp-proxy deployments), as versions 3.0.0 through 3.30.0 are affected. Because the leaked heap data may contain cleartext credentials from prior sessions, rotate credentials used through affected servers/proxies after patching and restrict which clients can connect to FreeRDP-based RDP endpoints. Audit installed FreeRDP 3.x versions in your estate and track the vendor advisory GHSA-v649-94v2-p72q for updates.

FreeRDP's Windows client before 3.29.0 contains a heap-based buffer overflow (CWE-122) in the clipboard virtual channel, where a CLIPRDR_FILE_CONTENTS_RESPONSE PDU is processed without validating the server-provided size against the destination buffer. The flaw is triggered when a user connects to a malicious or compromised RDP server and then performs a paste operation, at which point the server sends a data payload significantly larger than the client requested. The resulting heap memory corruption can allow the attacker to achieve remote code execution on the user's Windows workstation. Anyone running an affected FreeRDP Windows client version who connects to RDP servers they do not fully trust is exposed, since the CVSS 4.0 vector reflects network reachability with user interaction (the paste) but no privileges. Exploitation has not been reported in the wild; one public proof-of-concept advisory exists and EPSS currently assigns a low 0.5% probability of exploitation in the next 30 days.

Do: Upgrade the FreeRDP Windows client to version 3.29.0 or later, which fixes the missing size validation in the clipboard virtual channel. Until patched, instruct users to avoid paste operations when connected to untrusted or potentially compromised RDP servers, and inventory endpoints for FreeRDP client installations to confirm they are on a fixed version.

FreeRDP before 3.28.0 (affected out_length, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an unauthenticated attacker can forge a ciphertext whose decrypted value is up to the full modulus length (e.g. 256 bytes for RSA-2048), overflowing the 32-byte heap buffer by up to ~224 attacker-controlled bytes pre-authentication, resulting in denial of service.

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched with the non-default /cache:codec:rfx option pass desktop stride and height to RemoteFX decoding for Cache Bitmap V3 data while allocating bitmap->data only for the smaller DstWidth and DstHeight in gdi_Bitmap_Decompress, allowing a malicious RDP server to trigger a heap out-of-bounds write with attacker-controlled offset and content. This issue is fixed in version 3.27.1.

FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial of service.