Technical impact
FreeRDP versions before 3.30.0 contain a heap-based buffer overflow in the CliprdrStream_Read function used by the Windows clipboard client. When an OLE paste consumer requests to read data that the RDP server sends, the function copies the data into the consumer's buffer using the server‑supplied file size instead of the buffer length provided by the consumer. A remote RDP server can supply an oversized response, causing an out‑of‑bounds write of attacker‑controlled data into the consumer’s heap. This flaw can potentially allow arbitrary code execution on the client machine.
Affected Systems
The vulnerability affects the FreeRDP client software, specifically all releases up to and including 3.29.0. This includes every operating system where FreeRDP is used as an RDP client. No other vendors or products are listed as affected.
Risk and Exploitability
The flaw is rated 8.7 on the CVSS base score, indicating high severity. No EPSS score is available and the flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog. An attacker would need control of an RDP server that the victim connects to and the victim must trigger a paste action to exploit the overflow. Because the error occurs in the client, only the machine running the FreeRDP client is affected. Nonetheless, the attacker can force the client to receive malicious clipboard payloads, and subsequent paste can lead to memory corruption and potentially remote code execution.
