The vulnerability is a heap-use-after-free in the FreeRDP function xf_cliprdr_provide_data_. During a clipboard transfer, the client processes data in two threads: the cliprdr channel thread that prepares the data and the X11 event thread that clears cached data. The lack of a lock allows the first thread to use a pointer after the memory has been freed by the second thread, corrupting the heap. If an attacker can control the clipboard content or timing, they could trigger this memory corruption to crash the client or execute arbitrary code in the context of the running user. The bug is specific to the memory handling of clipboard data and does not affect authentication or network traffic directly.

All installations of the FreeRDP client before version 3.23.0 are affected. This includes any build that links against the xf_cliprdr module for X11, which is used by most desktop and headless deployments of FreeRDP. Systems that ship or compile the older mainline source will be vulnerable unless they apply the patch that became part of the 3.23.0 release.

The CVSS v3 score of 5.5 indicates moderate severity, and the EPSS score of less than 1% reflects a very low probability of exploitation in the wild at present. The flaw is not listed in CISA’s KEV catalog. Exploitation requires an active RDP session with clipboard redirection enabled and the ability to send improperly formed clipboard data. If achieved, the attack would land in the local user’s process space, potentially allowing privilege escalation or privilege-bound code execution. However, the low exploitation probability and moderate impact suggest a cautious but proactive stance.