Security readout for executives and security teams
Plain-English summary
This issue affects FreeRDP on Windows before version 2.4.0. A remote desktop clipboard file-transfer request was not checked sufficiently. The public record does not state the exact impact, so treat it as an exposure in RDP client workflows rather than a confirmed business-critical emergency.
Executive priority
Handle through normal vulnerability management unless FreeRDP is widely used in sensitive Windows remote-access workflows. The available evidence supports patch verification, but not emergency response absent additional vendor impact details or exploitation evidence.
Technical view
The flaw is in FreeRDP's Windows client clipboard redirection code, specifically wf_cliprdr_server_file_contents_request in client/Windows/wf_cliprdr.c. It involves missing validation for a FILECONTENTS_RANGE File Contents Request PDU. The cited fix is associated with the 2.4.0 release range.
Likely exposure
Exposure is most likely on Windows systems running FreeRDP versions before 2.4.0. The provided sources do not list CPEs, packaged distributions, or downstream products, so asset validation must confirm actual FreeRDP versions and usage.
Exploitation context
The source bundle does not cite active exploitation, public exploit availability, KEV listing, or a CVSS score. Because KEV is false and impact details are sparse, exploitation status should be considered unconfirmed from these sources.
Researcher notes
Analysis is limited by sparse public metadata: no CVSS, CWE, CPEs, or stated impact are included. Researchers should review the linked fix and 2.3.2-to-2.4.0 comparison to understand the validation changes without assuming exploitability beyond the record.
Mitigation direction
- Upgrade FreeRDP on Windows clients to version 2.4.0 or later.
- Identify downstream packages that bundle FreeRDP and check their vendor advisories.
- Review vendor guidance for any clipboard redirection hardening recommendations.
- Prioritize internet-adjacent or untrusted RDP workflows for version verification.
Validation and detection
- Inventory Windows endpoints and software images for FreeRDP installations.
- Confirm installed FreeRDP versions are 2.4.0 or later.
- Check whether clipboard file redirection is used in RDP workflows.
- Review package manager or vendor metadata for backported fixes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-37595 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/FreeRDP/FreeRDP/commit/0d79670a28c0ab049af08613621aa0c267f977e9CVE reference · x_refsource_MISC
- https://github.com/FreeRDP/FreeRDP/compare/2.3.2...2.4.0CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.