A newly disclosed heap buffer overflow in the FreeRDP Windows client’s clipboard channel allows a malicious RDP server to corrupt heap memory and potentially achieve remote code execution (RCE) on connecting endpoints when clipboard redirection is enabled.
Akallabeth has identified a critical flaw in FreeRDP’s Windows client, specifically the wfreerdp component handling the static clipboard virtual channel (cliprdr).
The issue appears when the client processes CBFILECONTENTSRESPONSE PDUs responses that carry file data for clipboard operations such as drag-and-drop or paste in Windows Explorer.
Critical FreeRDP Clipboard Flaw
A malicious RDP server can craft a response whose payload is significantly larger than what the client originally requested, exploiting insufficient bounds checking in the client’s copy routine.
The vulnerable logic hinges on a server-controlled size field (cbRequested) that is computed from the incoming packet length and then used directly as the copy length for CopyMemory, without validating it against the destination buffer size (cb).
Under typical conditions, cb reflects the legitimate file content size the client expects, while cbRequested can be manipulated up to 65,536 bytes, creating an out-of-bounds heap write scenario.
This flaw impacts FreeRDP Windows client builds up to version 3.28.0, with fixes shipped in subsequent releases such as 3.29.0.
Successful exploitation requires only that a victim uses FreeRDP to connect to a malicious or compromised RDP server with clipboard redirection enabled, which is on by default in the Windows client.
Once connected, the attacker waits for the user to trigger a clipboard file operation, for example, performing a paste (Ctrl+V) in Windows Explorer, which causes the client to send a file contents request over the clipboard virtual channel.
Instead of returning the requested amount of data, the malicious server replies with an oversized CLIPRDRFILECONTENTSRESPONSE where dataLen and derived cbRequested far exceed the original buffer size (cb).
The client’s CliprdrStreamRead function then invokes CopyMemory(pv, reqfdata, reqfsize) using the attacker-controlled reqfsize, writing beyond the allocated heap buffer and overwriting heap metadata and adjacent objects.
With favorable heap layout (“heap feng shui”), this overflow can corrupt IStream vtable pointers so that subsequent OLE calls (for example, Release, Read, or Stat) jump to attacker-chosen addresses, resulting in full control flow hijack and RCE within the FreeRDP process on Windows.
The flaw is rated critical due to its low interaction requirement and high impact: a connecting client can be compromised simply by interacting with clipboard-enabled file operations against a malicious RDP endpoint.
According to Akallabeth, exploitation yields arbitrary heap memory corruption and, in realistic exploitation scenarios, remote code execution under the security context of the FreeRDP client.
Mitigation
Organizations relying on FreeRDP for Windows should prioritize upgrading to the latest supported release where the clipboard channel has been patched and hardened.
Until patching is complete, security teams should disable clipboard redirection in RDP sessions, particularly for connections to untrusted or internet-facing servers.
For high-risk environments, consider isolating RDP traffic behind strong access controls, enforcing mutual authentication, and limiting outbound connections from RDP clients to trusted servers only.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
 on connecting endpoints when clipboard redirection is enabled.){kind=link}