Technical impact
The flaw is a heap buffer overflow in the clipboard virtual channel of the FreeRDP Windows client. When the client receives a CLIPRDR_FILE_CONTENTS_RESPONSE PDU, it does not validate the size field supplied by the server before copying the data into a destination buffer. If a malicious RDP server sends a payload larger than expected, the client writes past the end of the buffer, corrupting arbitrary heap memory and potentially enabling the attacker to execute code on the client when the user performs a paste operation.
Affected Systems
These issues affect FreeRDP Windows client builds prior to version 3.29.0. All releases before the 3.29.0 milestone are vulnerable regardless of the operating system they run on, as the buffer overflow exists in the core clipboard handling code.
Risk and Exploitability
The CVSS score is 9.4, indicating a critical severity level, and the vulnerability is not currently listed in the CISA KEV catalog. The EPSS score of 0.00489 suggests a low exploitation probability, but it still indicates that the vulnerability can be exploited in the wild. The attack requires a compromised or impersonated RDP server and a user who performs a paste operation after the oversized response. Because the vector is remote, any entity that can establish an RDP session to an affected client could potentially exploit the flaw.
