GHSA-cj9v-h4hq-29jr: FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr
FreeRDP Windows client before 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel when processing CLIPRDRFILECONTENTSRESPONSE PDUs without validating the server-provided size against the destination buffer. A malicious RDP server can send a response with a data payload significantly larger than requested, causing arbitrary heap memory corruption that may enable remote code execution when a user performs a paste operation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDP Windows Clientto a version that resolves this vulnerability.Fixed in 3.29.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker operating a malicious RDP server can exploit the issue against a user of the affected FreeRDP Windows client. Exploitation requires the user to connect to that server and perform a paste operation.
Is authentication or a special client configuration required for exploitation?
The vulnerability is reachable over the network and does not require attacker privileges. The available information identifies clipboard virtual-channel processing during a paste operation as the relevant condition, but does not state whether clipboard redirection is enabled by default.
What is the impact of a successful exploit?
A malicious server can cause arbitrary heap memory corruption by returning clipboard file-content data larger than the client requested. This may enable remote code execution with the impact affecting confidentiality, integrity, and availability.
Which versions are affected?
FreeRDP Windows Client versions before 3.29.0 are affected. Upgrading to version 3.29.0 or later removes the affected version range described in the advisory.