CVE-2026-121962: 
NixOS 脆弱性分析と緩和策

CVE-2026-121962 is a heap buffer overflow vulnerability in FreeRDP's transport_default_read_pdu function, triggered by partial Early User Authorization (EUA) reads during PROTOCOL_HYBRID_EX CredSSP authentication. A malicious RDP server can split the four-byte EUA result into short reads that advance the stream pointer beyond the 16 KiB allocation, causing an out-of-bounds write and client denial of service. All FreeRDP versions before 3.32.2 are affected; version 3.32.2 is the patched release. It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 7.2 (High) (GitHub Advisory, FreeRDP Advisory).

The root cause is an out-of-bounds write (CWE-787) in the EUA branch of transport_default_read_pdu (libfreerdp/core/transport.c, lines 1140–1146). The function calls Stream_EnsureCapacity(s, 4), which checks total buffer capacity rather than remaining space at the current stream pointer; transport_read_layer_bytes then writes incoming bytes at Stream_Pointer(s) and advances the pointer on each partial read. A malicious server that dribbles the four-byte EUA response in chunks of 1–3 bytes causes repeated partial reads that progressively move the stream position beyond the 16 KiB heap allocation, resulting in an attacker-controlled sequential heap overwrite. The ordinary PDU branch uses remaining-capacity accounting and is not affected; only the EUA branch lacks this guard (FreeRDP Advisory).

Successful exploitation causes an out-of-bounds heap write on the FreeRDP client. In builds compiled with WinPR assertions enabled (the upstream default), Stream_Seek aborts the client process at the boundary, resulting in a client-side denial of service. In assert-free builds — observed in Debian, Fedora, and Arch packaging recipes — the overwrite continues with attacker-controlled content, potentially enabling control-flow hijack or remote code execution, though no reliable code execution primitive was demonstrated in the published PoC. There is no confidentiality impact; integrity and availability of the client process are both rated High (FreeRDP Advisory, GitHub Advisory).

A complete, standalone proof-of-concept (PoC) in C is publicly available in the FreeRDP security advisory, including compilation flags and AddressSanitizer runtime instructions (FreeRDP Advisory). The PoC demonstrates the heap buffer overflow via a loopback socket harness simulating a malicious server sending three-byte partial reads. Exploitation requires user interaction — the victim must connect to a malicious or compromised RDP server that successfully completes CredSSP — and is not automatable. The EPSS score is 0.0 and there is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion at this time (GitHub Advisory).

1. Set up a malicious RDP server: Deploy a server capable of completing PROTOCOL_HYBRID_EX CredSSP negotiation with a FreeRDP client (versions before 3.32.2). The server must be able to intercept or control the Early User Authorization (EUA) response phase.
2. Lure the victim client: Social-engineer or redirect a target user running a vulnerable FreeRDP client to connect to the malicious RDP server (e.g., via a crafted RDP file, phishing link, or DNS/ARP spoofing for a man-in-the-middle position).
3. Complete CredSSP handshake: Allow the CredSSP/NLA handshake to complete normally so the connection reaches the EUA result exchange phase.
4. Send fragmented EUA response: Instead of sending the four-byte EUA result in a single write, split it into multiple short writes (e.g., 3 bytes at a time). Each partial read advances Stream_Pointer(s) without bounds checking against remaining capacity.
5. Trigger out-of-bounds write: Repeat the partial writes until the stream position exceeds the 16 KiB heap allocation. In assert-free builds, subsequent reads write attacker-controlled bytes past the buffer boundary. In assertion-enabled builds, the client process aborts (DoS).
6. Achieve impact: In assert-free client builds, leverage the sequential heap overwrite for potential control-flow hijack; in assertion-enabled builds, the result is client crash/denial of service (FreeRDP Advisory).

• Network: Repeated RDP connections from a client to an unusual or newly observed RDP server IP; RDP sessions that complete NLA/CredSSP but terminate abnormally shortly after authentication.
• Process: Unexpected crash or abort of the FreeRDP client process (xfreerdp, wlfreerdp, or similar) immediately after connecting to an RDP server; crash dumps referencing transport_default_read_pdu or Stream_Seek in the stack trace.
• Logs: AddressSanitizer reports indicating heap-buffer-overflow write in transport_read_layer or transport_default_read_pdu; WinPR assertion failure messages such as MAXOOB write offset=16384 size=4 in client stderr or system logs.
• File System: Core dump files generated by the FreeRDP client process in the working directory or /var/crash/, timestamped around the time of the suspicious RDP connection (FreeRDP Advisory).

Upgrade FreeRDP to version 3.32.2 or later, which is the patched release addressing this vulnerability (GitHub Advisory, FreeRDP Advisory). As a workaround prior to patching, avoid connecting FreeRDP clients to untrusted or unknown RDP servers, and implement network segmentation to restrict RDP connections to known, trusted servers only. Organizations should also consider enabling WinPR assertions in their FreeRDP builds to limit exploitation to denial of service rather than potential code execution in assert-free configurations.

The vulnerability was discovered by researchers Kushalkhemka, mayank-jangid-moon, and the opensec-intelligence tool, and published by FreeRDP maintainer akallabeth on October 20, 2026 (FreeRDP Advisory). The advisory notes that assert-free packaging in Debian, Fedora, and Arch Linux could expose users to more severe impact than the upstream default, which limits exploitation to client denial of service. No significant broader media coverage or notable social media reactions beyond the advisory and standard vulnerability aggregator coverage have been identified at this time.