FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStream_Read function (client/Windows/wf_cliprdr…

FreeRDP versions 3.29.0 and earlier contain a heap-based buffer overflow vulnerability in the Windows clipboard client's CliprdrStream_Read function located in client/Windows/wf_cliprdr.c. The flaw occurs because the function copies RDP server response data into a caller-supplied buffer using the server-supplied length (req_fsize) rather than the caller's buffer size (cb). A malicious or compromised RDP server can return an oversized CB_FILECONTENTS_RESPONSE payload, triggering an out-of-bounds write of attacker-controlled data into the heap buffer of an OLE paste consumer such as explorer.exe. The vulnerability is triggered when a user pastes server-offered clipboard file contents, making it exploitable through user interaction with a rogue RDP server. The issue has been patched in FreeRDP 3.30.0. A fix is available via a specific commit on the FreeRDP GitHub repository, and a security advisory has been published under GHSA-m37j-jcr2-8gcc.