CVE-2026-121963: 
NixOS 脆弱性分析と緩和策

CVE-2026-121963 is a use-after-free vulnerability in FreeRDP's asynchronous dynamic rdpsnd (audio) channel that allows a malicious RDP server to crash the connecting FreeRDP client. The flaw exists in all FreeRDP versions before 3.32.2, including confirmed affected versions 2.11.8, 3.0.0, 3.21.0, 3.22.0, 3.31.1, and 3.32.0. It was published on November 4, 2026, with the security advisory authored by the FreeRDP project. The vulnerability carries a CVSS v3.1 base score of 5.9 (Medium) and a CVSS v4.0 base score of 8.2 (High) (FreeRDP Advisory, GitHub Advisory).

The root cause is a race condition (CWE-362) combined with a use-after-free (CWE-416) in channels/rdpsnd/client/rdpsnd_main.c. When a FreeRDP client uses asynchronous rdpsnd over a dynamic virtual channel (DVC), the DATA callback posts a copied PDU to the playback queue; however, rdpsnd_on_close() — triggered by the DVC close path in channels/drdynvc/client/drdynvc_main.c — frees the channel callback and audio device while free_internals only decrements the reference count from two to one without joining the playback thread. The surviving playback thread subsequently processes the queued training PDU and dereferences the freed listener_callback->channel_callback->channel pointer inside rdpsnd_virtual_channel_write, producing a heap-use-after-free. A public ASan harness (rdpsnd_uaf.c) reproduces the defect by forcing the specific lock-ordering interleaving and has been verified with AddressSanitizer output (FreeRDP Advisory).

Successful exploitation results in a client-side memory-safety violation and process termination (denial of service), as the freed heap object is read by the playback worker thread. There is no demonstrated impact on confidentiality or integrity — code execution and information disclosure were explicitly ruled out in the advisory. The attack scope is limited to the FreeRDP client process; no lateral movement or data exfiltration has been demonstrated (FreeRDP Advisory, GitHub Advisory).

A proof-of-concept ASan harness (rdpsnd_uaf.c) is publicly available via the FreeRDP security advisory, demonstrating the heap-use-after-free under a forced scheduling order; however, it is a local in-process reproducer rather than a live network exploit (FreeRDP Advisory). The vulnerability is not automatable (NVD SSVC: automatable=no) and requires high attack complexity due to the race condition timing window. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the EPSS score is 0.0. The CVE is not listed in the CISA KEV catalog (GitHub Advisory).

1. Set up a malicious RDP server: Configure a server that supports dynamic virtual channels (DVC) and the rdpsnd audio channel, targeting FreeRDP clients running versions before 3.32.2 with asynchronous dynamic rdpsnd enabled (FreeRDP_SynchronousDynamicChannels == FALSE).
2. Establish a client connection: Wait for or socially engineer a FreeRDP client to connect to the malicious server. No authentication or user interaction beyond initiating the RDP session is required.
3. Open the dynamic rdpsnd channel: Initiate the DVC rdpsnd channel handshake so the client allocates the channel callback and starts the asynchronous playback thread (reference count reaches 2).
4. Send a crafted SNDC_TRAINING PDU: Transmit an 8-byte audio training PDU (SNDC_TRAINING message type) to the client, causing the DATA callback to post a copy of the PDU to the client's playback message queue.
5. Immediately close the channel: Send a DVC close request, triggering rdpsnd_on_close() on the client, which frees the channel callback and audio device while the playback thread is still alive (reference count drops to 1 but the thread is not joined).
6. Race condition triggers UAF: The surviving playback thread dequeues the training PDU and calls rdpsnd_virtual_channel_write(), which dereferences the now-freed listener_callback->channel_callback->channel pointer, causing a heap-use-after-free and crashing the client process (FreeRDP Advisory).

• Process: Unexpected crash or termination of the FreeRDP client process (xfreerdp, wfreerdp, or embedded FreeRDP consumers) during or shortly after RDP session establishment, particularly when audio redirection is active.
• Logs: Application crash logs or core dumps referencing rdpsnd_virtual_channel_write or rdpsnd_on_close in the stack trace; AddressSanitizer output (if enabled) reporting heap-use-after-free at rdpsnd_virtual_channel_write with the free originating in rdpsnd_on_close.
• Network: RDP sessions to unfamiliar or untrusted server IP addresses that terminate abnormally shortly after connection; DVC channel open/close sequences for the rdpsnd channel occurring in rapid succession (open → audio PDU → close within milliseconds) in network captures (FreeRDP Advisory).

Upgrade FreeRDP to version 3.32.2 or later, which contains the fix for this vulnerability (FreeRDP Advisory, GitHub Advisory). As a workaround, restrict FreeRDP client connections to trusted, known-good RDP servers and implement network-level controls (e.g., firewall rules, VPN) to prevent connections to untrusted RDP endpoints. Disabling asynchronous dynamic audio channel support (if configurable in the deployment) would also eliminate the vulnerable code path. The advisory recommends that the fix drain or stop and join the dynamic rdpsnd playback worker before callback and device destruction, and clear the listener's callback pointer with proper synchronization.

The vulnerability was credited to researchers Kushalkhemka, mayank-jangid-moon (finders), and opensec-intelligence (tool) in the FreeRDP security advisory (FreeRDP Advisory). The advisory notes this is a residual dynamic-channel callback issue in the family of GHSA-vcgv-xgjp-h83q / CVE-2026-24684, which addressed a different playback-thread sink in version 3.22.0, indicating ongoing scrutiny of FreeRDP's DVC lifetime management. Social media activity was observed on Mastodon (infosec.exchange) and Bluesky shortly after disclosure, consistent with routine CVE notification traffic.