Security readout for executives and security teams
Plain-English summary
This CVE affects FreeRDP on Windows before version 2.4.0. A missing input check in clipboard file-content handling could let malformed remote desktop clipboard data reach vulnerable client code. The public record does not provide CVSS, impact detail, or confirmed exploitation.
Executive priority
Treat this as a targeted patch-management item, not an emergency based on current evidence. Prioritize environments with Windows FreeRDP clients in operational use, especially where remote desktop clipboard workflows are common.
Technical view
The issue is in wf_cliprdr_server_file_contents_request within client/Windows/wf_cliprdr.c. Sources describe missing validation for a FILECONTENTS_SIZE File Contents Request PDU. The affected scope is FreeRDP before 2.4.0 on Windows; available references point to the fixing commit and the 2.3.2-to-2.4.0 comparison.
Likely exposure
Exposure is most likely where Windows systems run FreeRDP versions earlier than 2.4.0 and process RDP clipboard file-content requests. The source bundle does not identify packaged downstream products, default configurations, or server-side exposure.
Exploitation context
CISA KEV status is false in the provided bundle, and no cited source confirms active exploitation. The public description is sparse, so exploitability, required user interaction, and practical impact cannot be stated confidently from the supplied evidence.
Researcher notes
The evidence supports a narrow statement: missing input validation in Windows FreeRDP clipboard file-content request handling before 2.4.0. The bundle lacks CVSS, CWE, detailed impact, affected downstream packages, and exploitation proof, so analysis should avoid broader claims.
Mitigation direction
- Upgrade Windows FreeRDP clients to version 2.4.0 or later.
- Check FreeRDP vendor guidance for supported upgrade and hardening recommendations.
- Prioritize systems that use RDP clipboard or file-content redirection workflows.
- Track downstream packages that may bundle vulnerable FreeRDP versions.
Validation and detection
- Inventory Windows endpoints and applications for FreeRDP versions before 2.4.0.
- Confirm deployed builds include the fixed code from the referenced commit or later release.
- Review SBOMs and package manifests for embedded FreeRDP components.
- Record whether affected systems use clipboard file-content redirection features.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-37594 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/FreeRDP/FreeRDP/commit/0d79670a28c0ab049af08613621aa0c267f977e9CVE reference · x_refsource_MISC
- https://github.com/FreeRDP/FreeRDP/compare/2.3.2...2.4.0CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.