CVE-2026-22852: 
NixOS vulnerability analysis and mitigation

CVE-2026-22852 is a heap-buffer-overflow vulnerability in FreeRDP's Audio Input (AUDIN) channel processing that allows a malicious RDP server to trigger memory corruption in the FreeRDP client. The flaw exists in all FreeRDP versions prior to 3.20.1 and affects only FreeRDP-based clients (not servers). It was disclosed on January 14, 2026, by researcher ehdgks0627 and fixed in the same-day release of FreeRDP 3.20.1. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 6.8 (Medium) (FreeRDP Advisory, Red Hat Bugzilla).

The root cause is an out-of-bounds write (CWE-787) in the audin_process_formats function within channels/audin/client/audin_main.c. When processing MSG_SNDIN_FORMATS PDUs, the function allocates a fresh callback->formats array sized to the current NumFormats value but fails to reset callback->formats_count from a prior invocation. On a second MSG_SNDIN_FORMATS PDU, the stale counter causes the write loop (callback->formats[callback->formats_count++] = format) to write past the end of the newly allocated array, resulting in heap corruption. An attacker controls this by operating a malicious RDP server that sends two consecutive MSG_SNDIN_FORMATS PDUs with all formats marked as compatible, triggering the overflow on the second message (FreeRDP Advisory).

A malicious RDP server can exploit this vulnerability to cause a crash (denial of service) in the connecting FreeRDP client due to heap memory corruption. Depending on heap layout and allocator behavior, the out-of-bounds write may also enable arbitrary code execution on the client system. The vulnerability affects confidentiality, integrity, and availability at a high level, and only FreeRDP-based clients are at risk — FreeRDP-based servers are not affected (FreeRDP Advisory, Red Hat Bugzilla).

A proof-of-concept exploit is publicly available via the FreeRDP GitHub security advisory, demonstrating the crash using AddressSanitizer. The PoC requires connecting a FreeRDP client to a malicious server that sends two MSG_SNDIN_FORMATS PDUs on the AUDIN channel. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.042%, reflecting low current exploitation probability (FreeRDP Advisory, Feedly).

1. Set up a malicious RDP server: Deploy a custom or modified RDP server capable of sending crafted AUDIN channel messages, specifically two consecutive MSG_SNDIN_FORMATS PDUs with NumFormats = N and all formats marked as compatible.
2. Lure the victim client: Trick a user running a vulnerable FreeRDP client (version ≤ 3.20.0) into connecting to the malicious server — for example, via a phishing link, a rogue network, or a compromised RDP gateway.
3. Trigger the AUDIN channel negotiation: Upon connection, the server initiates the Audio Input (AUDIN) dynamic virtual channel. The server sends the first MSG_SNDIN_FORMATS PDU, which causes the client to allocate callback->formats sized to NumFormats and populate callback->formats_count.
4. Send the second MSG_SNDIN_FORMATS PDU: The server immediately sends a second MSG_SNDIN_FORMATS PDU with the same or different NumFormats. The client allocates a new callback->formats array but retains the stale callback->formats_count from the first PDU.
5. Trigger heap overflow: The write loop in audin_process_formats (line 251 of audin_main.c) writes past the end of the newly allocated array, causing heap corruption. This results in a crash (DoS) and potentially exploitable memory corruption depending on heap layout (FreeRDP Advisory).

• Process: FreeRDP client process (xfreerdp, wfreerdp, etc.) crashes unexpectedly during or shortly after RDP session establishment, particularly when audio redirection is enabled.
• Logs: Application crash logs or core dumps referencing audin_process_formats in channels/audin/client/audin_main.c; AddressSanitizer output showing heap-buffer-overflow at audin_main.c:251 if ASan-enabled builds are in use.
• Network: Unusual RDP server sending multiple MSG_SNDIN_FORMATS PDUs on the AUDIN dynamic virtual channel in rapid succession during session setup; connections to unexpected or untrusted RDP server IP addresses.
• File System: Core dump files generated by the FreeRDP client process in the working directory or system crash directory following RDP connection attempts (FreeRDP Advisory).

Upgrade FreeRDP to version 3.20.1 or later, which resets callback->formats_count and properly bounds the write loop to prevent the overflow (FreeRDP Release). Red Hat has issued multiple errata addressing this CVE across RHEL 7 through 10 (RHSA-2026:6340, RHSA-2026:6727, RHSA-2026:6743, RHSA-2026:6799, RHSA-2026:6918, and others); users of RHEL-based distributions should apply the relevant errata (Red Hat Bugzilla). Patches have also been released for openSUSE, Ubuntu, Fedora, Amazon Linux 2, Mageia, AlmaLinux, Rocky Linux, and Debian. As a temporary workaround where patching is not immediately possible, restrict FreeRDP clients to connecting only to trusted, known-good RDP servers, and disable audio input redirection (/audio-mode:0 or equivalent) to prevent the AUDIN channel from being negotiated.

The vulnerability was discovered and reported by researcher ehdgks0627, who also identified eight other medium-severity vulnerabilities in FreeRDP fixed in the same 3.20.1 release (FreeRDP Release). The FreeRDP maintainer (akallabeth) published the advisory and patch on January 14, 2026, the same day as disclosure. Coverage has been picked up by Linux security news aggregators including linuxsecurity.com and linuxcompatible.org, reflecting broad distribution-level patching activity across major Linux vendors. No significant social media controversy or high-profile researcher commentary beyond the initial disclosure has been observed.