FreeRDP Clipboard Vulnerability Enables Remote Code Execution via Malicious RDP Servers

A newly disclosed heap buffer overflow vulnerability in the FreeRDP Windows client exposes users to remote code execution (RCE) when connecting to malicious or compromised Remote Desktop Protocol (RDP) servers with clipboard redirection enabled.

Security researcher Akallabeth identified the critical flaw in FreeRDP’s Windows client, specifically within the wfreerdp component responsible for handling the clipboard virtual channel (cliprdr). The issue arises during the processing of CBFILECONTENTSRESPONSE Protocol Data Units (PDUs), which are used to transfer file data during clipboard operations such as copy-paste or drag-and-drop in Windows Explorer.

The vulnerability stems from improper bounds checking when handling server-supplied clipboard data. During normal operation, the client requests file content from the server and expects a response matching the requested size. However, a malicious RDP server can manipulate this behavior by sending a response significantly larger than expected.

The core issue lies in a server-controlled size field (cbRequested), which is derived from the incoming packet length. This value is directly used as the copy size in a CopyMemory operation without validating it against the destination buffer size (cb). While cb represents the legitimate expected size, cbRequested can be maliciously inflated up to 65,536 bytes.

This mismatch results in an out-of-bounds heap write, enabling attackers to overwrite adjacent memory regions. The vulnerable logic is triggered in the CliprdrStreamRead function, where attacker-controlled data is copied into a fixed-size buffer.

Exploitation of this flaw requires minimal user interaction. A victim must connect to a malicious RDP server using the FreeRDP Windows client with clipboard redirection enabled, which is the default configuration.

Once connected, the attacker waits for the user to initiate a clipboard-related action, such as pasting a file using Ctrl+V in Windows Explorer. This action triggers a file content request over the clipboard channel. Instead of returning the expected data size, the malicious server responds with a crafted CLIPRDRFILECONTENTSRESPONSE containing excessive data.

The oversized payload causes a heap overflow, potentially corrupting critical structures such as IStream virtual function tables. With precise heap manipulation techniques (commonly referred to as “heap feng shui”), attackers can redirect execution flow to arbitrary memory addresses.

This can lead to full remote code execution within the context of the FreeRDP client process, allowing attackers to execute arbitrary code on the victim’s system.

The vulnerability affects FreeRDP Windows client versions up to 3.28.0. It has been addressed in version 3.29.0 and later releases.

Due to its low interaction requirements and high impact, the flaw has been classified as critical. Successful exploitation enables arbitrary heap corruption and, in practical scenarios, reliable RCE under the user context running the FreeRDP client.

Mitigation

Organizations and users relying on FreeRDP should take immediate steps to mitigate the risk:

• Upgrade FreeRDP to version 3.29.0 or later, where the vulnerability has been patched.
• Disable clipboard redirection for RDP sessions, especially when connecting to untrusted or external servers.
• Restrict RDP access using strong authentication mechanisms and network-level controls.
• Limit outbound RDP connections to trusted infrastructure only.
• Monitor RDP sessions for anomalous clipboard activity or unexpected data transfers.

For high-security environments, additional isolation measures such as network segmentation and hardened endpoint configurations are recommended.

This vulnerability highlights the risks associated with implicit trust in remote servers and reinforces the need for strict validation of external inputs in client-server architectures.