FreeRDP versions prior to 3.32.0 contain a heap out‑of‑bounds read in the clipboard conversion routine. The routine scans a server‑supplied FILEDESCRIPTORW structure with unbounded string operations that lack a guaranteed NUL terminator. When a malicious RDP server sends an odd‑length blob as part of a clipboard response, the client attempts to read past the allocated buffer, causing the X11, Wayland, or SDL session to crash. The flaw leads to a denial of service, not data exposure or code execution, but it can be triggered during normal user interaction when pasting server‑copied files.

The vulnerability is present in FreeRDP 3.0.0 through 3.31.x on all platforms that use the WinPR clipboard code. Users running FreeRDP clients on X11, Wayland, or SDL are affected. Any RDP connection to a server that supplies malicious clipboard data can trigger the crash.

The CVSS score of 6.9 indicates a moderate severity vector. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack path involves a remote RDP server delivering a specially crafted FILEDESCRIPTORW blob; exploitation requires the user to paste the clipboard content. Because the bug results in a crash rather than code execution, the immediate risk is limited to service interruption, but it can be disruptive in environments where the client is critical.