CVE-2025-68118: 
NixOS vulnerability analysis and mitigation

CVE-2025-68118 is a heap-based out-of-bounds read vulnerability in FreeRDP's certificate handling code on Windows platforms, specifically within the freerdp_certificate_data_hash_ function. The function uses Microsoft's _snprintf to format certificate cache filenames without guaranteeing NUL termination when the output is truncated, which can be triggered by an attacker-controlled hostname via server redirection or a crafted .rdp file. All FreeRDP versions prior to 3.20.0 (up to and including 3.19.1) are affected. It was disclosed on December 17, 2025, with a CVSS v3.1 base score of 9.1 (Critical) per NVD, though the GitHub advisory rates it as Low severity (GitHub Advisory, Red Hat).

The root cause is classified as CWE-125 (Out-of-bounds Read). The freerdp_certificate_data_hash_ function in libfreerdp/crypto/certificate_data.c calls _snprintf to construct certificate cache filenames; unlike standard snprintf, Microsoft's _snprintf does not append a NUL terminator when the formatted output exceeds the buffer size. If an attacker supplies a hostname exceeding the buffer capacity — via a crafted .rdp file or RDP server redirection — the resulting buffer is not NUL-terminated, and subsequent strnlen or _strdup calls may read beyond the allocated heap region. The patch (commit a0b21f9) addresses this by passing sizeof(buffer) - 1 to reserve space for NUL termination, adding a hostname length check against MAX_PATH, and replacing _strdup with strndup (GitHub Commit, GitHub Advisory).

Successful exploitation can result in unintended heap memory reads, potentially exposing sensitive data present in the FreeRDP client process memory, or causing the client to crash (denial of service). In default configurations, the RDP connection is typically terminated before sensitive data can be meaningfully extracted; however, under certain conditions, memory disclosure or client availability impact remains possible. The vulnerability affects only Windows platform builds of FreeRDP and does not impact server-side components (GitHub Advisory, Red Hat).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat). The EPSS score is approximately 0.033%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Exploitation requires the victim to connect to a malicious or redirected RDP server, or open a crafted .rdp file, making user interaction a practical prerequisite despite the NVD scoring.

1. Prepare a malicious RDP server or crafted .rdp file: Set up an RDP server configured to redirect the client to a hostname exceeding the MAX_PATH buffer limit, or craft a .rdp file with an excessively long full address or redirected hostname value.
2. Deliver the payload: Distribute the crafted .rdp file to the target user via phishing, or position the attacker-controlled server as a redirect target in an RDP session broker or gateway scenario.
3. Trigger the vulnerable code path: When the FreeRDP client (on Windows) connects and processes the certificate for the attacker-controlled hostname, freerdp_certificate_data_hash_ calls _snprintf with the oversized hostname, resulting in a non-NUL-terminated buffer.
4. Achieve out-of-bounds read: Subsequent string operations (strnlen, _strdup) on the unterminated buffer read beyond the allocated heap region, potentially leaking adjacent heap memory contents or causing a client crash (GitHub Advisory, GitHub Commit).

• Network: Outbound RDP connections from Windows hosts to unexpected or unknown RDP servers; RDP session redirections to hostnames with unusually long strings (exceeding 260 characters).
• Logs: FreeRDP client logs showing certificate handling errors or hostname exceeds length limits messages (present in patched versions); unexpected connection terminations during certificate validation phase.
• Process: FreeRDP client process (wfreerdp.exe or similar) crashing or exiting abnormally shortly after initiating a connection; crash dump files generated in the FreeRDP working directory.
• File System: Presence of crafted .rdp files with abnormally long full address fields delivered via email attachments or downloads.

Upgrade FreeRDP to version 3.20.0 or later, which contains the fix introduced in commit a0b21f9 (GitHub Commit). As interim mitigations, organizations should restrict the opening of untrusted .rdp files and disable or tightly control RDP server redirection in environments where patching cannot be immediately applied. Users should only connect to trusted, known RDP servers to reduce exposure (GitHub Advisory, Red Hat).

The vulnerability was credited to researcher ret2ldz in the GitHub security advisory. Red Hat has acknowledged the CVE and published a tracking page. No significant broader media coverage or notable community discussion has been identified beyond standard vulnerability database entries (GitHub Advisory, Red Hat).