CVE-2026-121964: 
NixOS Schwachstellenanalyse und -minderung

CVE-2026-121964 is a heap-based buffer overflow vulnerability in FreeRDP's RD Gateway RPC client that allows a malicious or compromised RD Gateway to cause a client crash or potentially achieve arbitrary code execution. The flaw exists in the rpc_client_recv_fragment function, which writes BIND_ACK and ALTER_CONTEXT_RESP fragments into a persistent PDU stream using only a total-capacity check rather than a remaining-capacity check. All FreeRDP versions before 3.32.2 are affected; version 3.32.2 contains the fix. The vulnerability carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, FreeRDP Advisory).

The root cause is a heap-based buffer overflow (CWE-122) in libfreerdp/core/gateway/rpc_client.c. The BIND_ACK and ALTER_CONTEXT_RESP branch of rpc_client_recv_fragment calls Stream_EnsureCapacity(pdu->s, len), which only guarantees that the buffer's total allocated capacity is at least len — it does not account for the current write position within the stream. Because the persistent per-call stream pdu->s is not reset between fragments, a prior PTYPE_RESPONSE fragment with a mismatched alloc_hint and StubLength leaves the stream position at a non-zero offset (e.g., position 4055 in the PoC). A subsequent BIND_ACK write of len bytes at that offset then overruns the 4096-byte heap buffer allocated by rpc_pdu_new() by approximately 3904 bytes, with write length and content fully controlled by the attacker. Exploitation requires the victim FreeRDP client to be configured to use an RD Gateway (TSG path) and to connect to an attacker-controlled gateway, with certificate verification disabled or the attacker presenting an acceptable certificate (FreeRDP Advisory).

Successful exploitation causes a heap out-of-bounds write in the FreeRDP client process, with write length and content controlled by the attacker. The immediate, demonstrated impact is a client process crash (denial of service via abort/assertion failure or glibc heap corruption detection). The advisory notes that the memory corruption can serve as a starting point for arbitrary code execution with the privileges of the FreeRDP process, though code execution beyond a crash has not been demonstrated in the public PoC. Confidentiality and integrity of the client system are potentially at risk if code execution is achieved, while availability is definitively impacted (FreeRDP Advisory, GitHub Advisory).

A functional proof-of-concept exploit (gw_server.py) is publicly available in the FreeRDP security advisory, implementing a complete malicious RD Gateway server in Python that triggers the heap overflow without requiring authentication from the attacker's side. The PoC demonstrates a reliable client crash; arbitrary code execution is claimed but not demonstrated. No in-the-wild exploitation has been observed as of the advisory publication date, and the EPSS score is 0.0. The vulnerability is automatable (no user interaction required beyond the victim connecting to a malicious gateway) and has not been added to the CISA KEV catalog (FreeRDP Advisory, GitHub Advisory).

1. Set up malicious RD Gateway: Deploy the public PoC gw_server.py on an attacker-controlled host with a TLS certificate (self-signed is sufficient if the victim uses /cert:ignore). Start the server: python3 gw_server.py <PORT> <CERT> <KEY>.
2. Lure victim client: Direct a FreeRDP client running a vulnerable version (< 3.32.2) to connect through the attacker-controlled RD Gateway host and port, e.g., via social engineering, DNS poisoning, or a compromised network path.
3. Complete TLS and NTLM handshake: The malicious gateway performs a TLS handshake, responds to RPC_IN_DATA and RPC_OUT_DATA HTTP requests with HTTP 401 plus an NTLM Type 2 challenge, completing the authentication exchange to advance the client to the RPC context-negotiated state.
4. Complete RTS CONN handshake: The server sends CONN/A3 and CONN/C2 RTS PDUs on the OUT channel, then sends a secure BIND_ACK with an NTLM CHALLENGE token, causing the client to send RPC_AUTH_3 and reach CONTEXT_NEGOTIATED. The server registers call_id 2 from the client's TsProxyCreateTunnel request.
5. Poison stream position with crafted PTYPE_RESPONSE: Send a PTYPE_RESPONSE fragment with frag_length=4087 and alloc_hint=1. Because alloc_hint differs from StubLength (4055), rpc_client_recv_fragment appends stub bytes without resetting pdu->s, leaving the stream position at offset 4055.
6. Trigger heap overflow with crafted PTYPE_BIND_ACK: Send a PTYPE_BIND_ACK fragment with frag_length=4087. The code calls Stream_EnsureCapacity(pdu->s, 4087) (which passes since total capacity ≥ 4087) and then writes 4087 bytes at position 4055, overrunning the 4096-byte heap buffer by ~3904 bytes, causing a client crash or potential code execution (FreeRDP Advisory).

• Network: FreeRDP client connections to unexpected or untrusted RD Gateway hosts/ports; TLS connections from FreeRDP processes to non-corporate gateway IPs; unusual RPC-over-HTTP (ncacn_http) traffic patterns.
• Logs: FreeRDP client logs showing [FATAL][com.freerdp.winpr.assert] messages referencing stream.h:Stream_Write with remaining capacity errors; log entries indicating wStream API misuse: stream was written out of bounds; client abort signals (signal 6/SIGABRT) from the FreeRDP process.
• Process: Unexpected termination (crash) of the FreeRDP client process (xfreerdp, wfreerdp, or embedded FreeRDP) shortly after connecting to an RD Gateway; glibc heap corruption messages such as double free or corruption (!prev) in process output.
• File System: Core dump files generated by the FreeRDP process in the working directory or system core dump location following an unexpected abort (FreeRDP Advisory).

Upgrade FreeRDP to version 3.32.2 or later, which contains the fix for the incorrect capacity check in rpc_client_recv_fragment. As a network-level workaround, restrict FreeRDP client access to only trusted, verified RD Gateway servers and enforce certificate validation (do not use /cert:ignore in production). Organizations should also monitor for unexpected RD Gateway connections from client endpoints to untrusted hosts. No alternative code-level workaround is provided by the vendor beyond upgrading (FreeRDP Advisory, GitHub Advisory).

The vulnerability was reported by researcher smaeljaish771 and sponsored by KeenSecurityLab, and was published by FreeRDP maintainer akallabeth on October 20, 2026. Social media activity was observed on Mastodon and Bluesky shortly after NVD publication on November 4, 2026, with automated CVE tracking accounts noting the advisory. No significant broader media coverage or notable independent researcher commentary beyond the official advisory has been identified (FreeRDP Advisory).