FreeRDP before version 3.30.0 (<= 3.29.0) has a heap-based buffer overflow in the Windows clipboard client's CliprdrStream_Read function (client/Windows/wf_cliprdr.c). The issue arises because CliprdrStream_Read uses the server-supplied length (req_fsize) to copy data into a fixed-size buffer (cb bytes) without verifying that req_fsize does not exceed cb. A malicious or compromised RDP server can exploit this by returning an oversized CB_FILECONTENTS_RESPONSE, leading to an out-of-bounds write of attacker-controlled data into the heap buffer of the paste consumer process when a user pastes clipboard file contents.

Successful exploitation allows a malicious or compromised RDP server to cause a heap-based buffer overflow in the client process handling clipboard data, potentially leading to arbitrary code execution or denial of service. The vulnerability requires user interaction (pasting clipboard contents) and network access to a malicious RDP server. The CVSS 3.1 base score is 9.6, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on integrity and availability, and low impact on confidentiality.

No official patch or fix is currently confirmed for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid connecting to untrusted or potentially malicious RDP servers and refrain from pasting clipboard file contents received from such servers.