CVE-2026-22851: 
NixOS vulnerability analysis and mitigation

CVE-2026-22851 is a heap use-after-free vulnerability in FreeRDP's SDL client caused by a race condition between the RDPGFX dynamic virtual channel thread and the SDL render thread. It affects all FreeRDP versions up to and including 3.20.0, and was disclosed on January 14, 2026, with a fix released the same day in version 3.20.1. Only FreeRDP-based clients using the SDL3 client are affected; FreeRDP-based servers are not impacted. It carries a CVSS v3.1 base score of 5.9 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper cross-thread lifetime management of the primary SDL framebuffer (sdl->primary), classified as CWE-362 (Race Condition) and CWE-416 (Use After Free). In sdl_freerdp.cpp, a raw pointer to sdl->primary (an SDL_Surface) is captured into a local variable surface in the SDL render thread. Concurrently, when an RDPGFX_CMDID_RESETGRAPHICS packet is received, the RDPGFX dynamic virtual channel thread destroys and reinitializes sdl->primary via SDL_DestroySurface. The render thread then uses the now-dangling surface pointer for blitting operations (e.g., sdl_draw_to_window_rect), triggering a heap use-after-free. A proof-of-concept AddressSanitizer trace demonstrating the issue is included in the GitHub security advisory (GitHub Advisory).

Successful exploitation results in a heap use-after-free condition that causes the FreeRDP SDL client to crash, producing a denial-of-service impact with high availability impact. No direct information disclosure or confirmed remote code execution has been demonstrated, though the memory safety violation theoretically could enable further exploitation under specific conditions. The vulnerability is limited to FreeRDP SDL clients connecting to a malicious or compromised RDP server; FreeRDP servers and non-SDL clients are not affected (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept exploit (AddressSanitizer trace) is publicly available in the GitHub security advisory, but there is no evidence of active in-the-wild exploitation at this time. The vulnerability is remotely exploitable over the network without requiring privileges or user interaction, though high attack complexity is required due to the race condition timing requirements. The EPSS score is approximately 0.038%, indicating low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. It was discovered and reported by researcher ehdgks0627 (GitHub Advisory).

1. Setup a malicious RDP server: Configure a server capable of sending crafted RDPGFX protocol messages, specifically RDPGFX_CMDID_RESETGRAPHICS packets, to connected clients.
2. Lure or wait for a vulnerable SDL client to connect: The target must be running FreeRDP's SDL3 client (version ≤ 3.20.0) and connect to the attacker-controlled server.
3. Trigger the race condition: Send an RDPGFX_CMDID_RESETGRAPHICS packet at a moment when the SDL render thread has captured a raw pointer to sdl->primary but has not yet completed its blitting operation. This causes the RDPGFX channel thread to free and reinitialize sdl->primary while the render thread still holds a dangling reference.
4. Achieve use-after-free: The render thread calls sdl_draw_to_window_rect using the freed SDL_Surface pointer, triggering a heap use-after-free. Under normal conditions this causes a crash (denial of service); under specific heap layout conditions, further memory corruption may be possible (GitHub Advisory).

• Process: Unexpected crashes or aborts of the sdl-freerdp client process, particularly with AddressSanitizer errors referencing SDL_BlitCopy, sdl_draw_to_window_rect, or gdi_ResetGraphics in stack traces.
• Logs: Application crash logs or core dumps from the FreeRDP SDL client showing heap corruption or segmentation faults during active RDP sessions; error messages referencing RDPGFX_CMDID_RESETGRAPHICS handling.
• Network: Repeated or anomalous RDPGFX_CMDID_RESETGRAPHICS packets sent from an RDP server to the client during an active session, particularly in rapid succession to exploit the race window (GitHub Advisory).

Upgrade FreeRDP to version 3.20.1 or later, which fixes the issue by properly locking sdl->primary while it is in use (via the [client,sdl] lock primary while used commit). For systems unable to patch immediately, restrict network access to FreeRDP SDL clients and avoid connecting to untrusted or unknown RDP servers. Monitor FreeRDP SDL client processes for unexpected crashes that may indicate exploitation attempts (GitHub Release, GitHub Advisory).

The vulnerability was part of a batch of nine medium-severity CVEs (CVE-2026-22851 through CVE-2026-22859) disclosed simultaneously by the FreeRDP project on January 14, 2026, all credited to researcher ehdgks0627. Red Hat, SUSE, Fedora, Ubuntu, Debian, and openSUSE have all issued advisories or package updates addressing this and related FreeRDP vulnerabilities. The issue received routine coverage from Linux security news aggregators and distribution security teams, with no notable controversy or exceptional community reaction (GitHub Release, Red Hat Bugzilla).