A critical heap buffer overflow vulnerability in FreeRDP’s Windows client could allow a malicious Remote Desktop Protocol (RDP) server to corrupt memory and potentially execute arbitrary code on a connecting client.
This flaw specifically affects the Clipboard Redirection (CLIPRDR) virtual channel in wfreerdp, where an attacker-controlled response can exceed the size that the client originally requested.
Critical FreeRDP Clipboard Flaw
The issue is tracked as GHSA-cj9v-h4hq-29jr and affects FreeRDP version 3.28.0; version 3.29.0 includes the necessary fix.
FreeRDP’s advisory emphasizes that wfreerdp is no longer maintained and should not be used, highlighting the need for organizations to migrate to supported FreeRDP clients and current builds.
The vulnerability arises when wfreerdp processes a CLIPRDR_FILECONTENTS_RESPONSE message sent by an RDP server. During clipboard-based file transfers, the client requests a specific amount of file data from the server.
However, a malicious server can return a significantly larger payload and provide a server-controlled length value that is used in a CopyMemory operation without checking against the size of the destination buffer.
The vulnerable data path involves the functions cliprdr_read_file_contents_response, wf_cliprdr_server_file_contents_response, and CliprdrStreamRead. The protocol parser extracts cbRequested from the received message length but fails to confirm that this length matches or is smaller than the client’s original request.
[Malicious RDP Server]
│
▼ Sends CLIPRDR_FILE_CONTENTS_RESPONSE (dataLen = 65540)
│
channels/cliprdr/cliprdr_common.c:384
▼ cliprdr_read_file_contents_response()
│ response->cbRequested = response->common.dataLen - 4 → cbRequested = 65536
│ // ❌ No validation: cbRequested not checked against requested cb
│
client/Windows/wf_cliprdr.c:2449
▼ wf_cliprdr_server_file_contents_response()
│ clipboard->req_fsize = fileContentsResponse->cbRequested → req_fsize = 65536
│ // ❌ Directly accepts server value without comparing to original cb
│ SetEvent(clipboard->req_fevent) → Wakes waiting thread
│
client/Windows/wf_cliprdr.c:249
▼ CliprdrStream_Read()
│ CopyMemory(pv, clipboard->req_fdata, clipboard->req_fsize)
│ // 💥 pv size = cb = 16384, req_fsize = 65536
│ // 💥 49152 bytes out-of-bounds heap write!
▼
[Heap Memory Corruption → SIGSEGV / Process Crash]The callback stores this oversized value in clipboard->reqfsize, after which CliprdrStreamRead copies the server-supplied data into a buffer allocated for the smaller requested size.
For example, if a client requests 16 KB of clipboard file content, a malicious RDP server could respond with 64 KB. This operation would write approximately 48 KB beyond the intended heap allocation, potentially overwriting adjacent heap objects or heap-management metadata.
Such corruption can crash the FreeRDP process; however, under certain heap-layout conditions, it may also be exploited for control-flow hijacking and remote code execution.
Exploitation requires a victim to connect to an attacker-controlled RDP server with clipboard redirection enabled. Clipboard support is commonly enabled by default, and the vulnerable path can be accessed when the user performs a paste action, such as pressing Ctrl+V in Windows Explorer during an RDP session.
This makes phishing attacks, fraudulent remote-support requests, exposed test servers, and compromised RDP infrastructure plausible delivery scenarios.
Organizations should immediately update affected FreeRDP deployments to version 3.29.0 or later and identify environments still using the outdated wfreerdp client.
Until patching or migration is complete, administrators should disable clipboard redirection for untrusted RDP connections, restrict outbound RDP access, and ensure users verify the identity and authenticity of remote hosts before connecting.
Security teams should also monitor endpoint telemetry for unexpected FreeRDP crashes, suspicious RDP destinations, and anomalous clipboard virtual-channel activity.
ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
