CVE-2026-121961: 
NixOS analisi e mitigazione delle vulnerabilità

CVE-2026-121961 is a use-after-free race condition vulnerability in the FreeRDP freerdp-proxy DRDYNVC tracker that allows a malicious RDP target server to crash the proxy process. It affects all FreeRDP versions before 3.32.2 and was published on November 4, 2026, with the patch available in version 3.32.2. The vulnerability carries a CVSS v3.1 base score of 5.9 (Medium) and a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, FreeRDP Advisory).

The root cause is a concurrent execution race condition (CWE-362) combined with a use-after-free (CWE-416) in the proxy's DRDYNVC channel tracker. When freerdp-proxy is configured to intercept the drdynvc static channel, the backend thread and front thread share a per-channel DynamicChannelContext without proper lifetime management. A malicious target server repeatedly sends CREATE_REQUEST_PDU for an already-active channel ID; the backend thread calls HashTable_Remove and DynamicChannelContext_free (freeing the channel name string and context), while the front thread concurrently holds a borrowed pointer to the same context for DATA handling. Because HashTable_GetItemValue does not extend the context's lifetime, the front thread accesses freed memory — observed as a heap-use-after-free READ in dyn_log_/DynvcTrackerHandleCmdDATA under ASan, and as a SIGSEGV in __strlen_avx2 in non-instrumented runs. Exploitation requires an authenticated front session with active dynamic-channel data and a proxy explicitly configured with Intercept=drdynvc; a default proxy without an intercepting module does not enter this code path (FreeRDP Advisory).

Successful exploitation results in a crash (SIGSEGV or ASan abort) of the freerdp-proxy process, causing a denial of service for all sessions proxied through it. No confidentiality or integrity impact has been demonstrated — no controlled memory write, information disclosure, or code execution was achieved in any reported test. The attack is limited to the proxy process itself; downstream clients and the broader network are not directly affected beyond loss of proxy availability (FreeRDP Advisory, GitHub Advisory).

A focused proof-of-concept C harness (proxy_drdynvc_race.c) is publicly available in the FreeRDP security advisory, which compiles production tracker translation units and races front DATA against backend duplicate CREATE threads to trigger the crash. The exploit is classified as PoC-level (denial of service only, no code execution), and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA KEV catalog. Exploitation is not automatable due to the requirement for an authenticated front session and precise race timing (FreeRDP Advisory, GitHub Advisory).

1. Reconnaissance: Identify a freerdp-proxy deployment configured with Intercept=drdynvc (a non-default configuration) and confirm that front clients are actively using dynamic virtual channels.
2. Establish position as malicious target server: The attacker must control or compromise an RDP target server that the proxy connects to — no proxy credentials are required for the backend attacker.
3. Trigger an authenticated front session: Ensure a legitimate front client has an active authenticated session with dynamic channel data flowing through the proxy (the race requires concurrent front DATA traffic).
4. Send repeated duplicate CREATE_REQUEST_PDU: From the malicious target server, repeatedly send DRDYNVC CREATE_REQUEST_PDU messages for a channel ID that is currently active and in use by the front client, at high frequency to win the race window.
5. Race condition triggers use-after-free: The backend thread's HashTable_Remove and DynamicChannelContext_free free the channel context and its name string while the front thread's DATA handler still holds a borrowed pointer, causing a heap-use-after-free.
6. Proxy process crashes: The front thread accesses the freed channelName (e.g., in a logging call), resulting in SIGSEGV or ASan abort, crashing the proxy process and denying service to all proxied sessions (FreeRDP Advisory).

• Logs: Repeated CREATE_REQUEST_PDU messages for the same channel ID appearing in proxy debug logs from the same backend target server in rapid succession.
• Process: freerdp-proxy process terminating unexpectedly with SIGSEGV (signal 11), particularly in __strlen_avx2 or dyn_log_ call paths visible in core dumps or crash reports.
• File System: Core dump files generated by the freerdp-proxy process, potentially in the working directory or system core dump location (e.g., /var/crash/, /tmp/).
• Network: Anomalous high-frequency DRDYNVC channel creation PDUs from a backend RDP target server to the proxy, especially targeting the same channel ID repeatedly within short time windows (FreeRDP Advisory).

Upgrade FreeRDP to version 3.32.2 or later, which contains the fix for this vulnerability. As a configuration-based workaround, avoid enabling Intercept=drdynvc in the proxy configuration unless strictly necessary, as a default proxy without an explicit drdynvc intercepting module does not enter the vulnerable code path. Additionally, restrict network access to the FreeRDP proxy's backend connections so that only trusted RDP target servers can connect, reducing exposure to malicious server-side attacks (FreeRDP Advisory, GitHub Advisory).

The advisory was published by FreeRDP maintainer akallabeth and credits researchers Kushalkhemka, mayank-jangid-moon (finders), and opensec-intelligence (tool). The vulnerability was assigned moderate severity by the FreeRDP project itself (CVSS v3.1: 5.9), though the GitHub Advisory Database rates it High based on CVSS v4.0 (8.2). No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability aggregator indexing (FreeRDP Advisory).