CVE-2026-22853: 
NixOS vulnerability analysis and mitigation

CVE-2026-22853 is a heap buffer overflow vulnerability in FreeRDP's RDPEAR NDR array reader (ndr_read_uint8Array) that allows a malicious RDP server to trigger client-side memory corruption. It affects all FreeRDP versions prior to 3.20.1 and impacts only FreeRDP-based clients (not servers). The vulnerability was disclosed on January 14, 2026, and fixed in FreeRDP 3.20.1 released the same day. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 6.8 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an out-of-bounds write (CWE-787) in ndr_read_uconformant_array within channels/rdpear/common/ndr.c. The buffer is allocated using itemCount = ndr_hintsCount(descr, hints), sizing it based on hints->count, but the bounds check count * itemSize < hints->count is flawed — it does not prevent count from exceeding hints->count. As a result, the subsequent write loop iterates count times into a buffer sized for only hints->count elements, writing past the end of the heap allocation. Exploitation requires a client to connect to a malicious RDP server that sends a crafted RDPEAR packet with an inflated on-wire element count, triggering the overflow during rdpear_kerb_DecryptApReply processing. A proof-of-concept Python payload demonstrating the overflow was included in the security advisory (GitHub Advisory).

A malicious RDP server can trigger a client-side heap buffer overflow in FreeRDP-based clients, leading to a crash (denial of service) and potential heap corruption. Depending on allocator behavior and surrounding heap layout, this could escalate to arbitrary code execution on the connecting client. Confidentiality, integrity, and availability are all rated HIGH under CVSS v3.1. Only FreeRDP-based clients are affected; FreeRDP servers and the FreeRDP proxy are not impacted by this specific CVE (GitHub Advisory, FreeRDP Release).

A proof-of-concept payload was published as part of the GitHub Security Advisory at the time of disclosure, demonstrating the heap buffer overflow via crafted RDPEAR packets. The CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.042%, indicating low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Set up a malicious RDP server: Deploy a rogue RDP server (e.g., a modified FreeRDP server or custom implementation) that can send crafted RDPEAR channel data to connecting clients.
2. Lure a victim client to connect: Social-engineer or redirect a target FreeRDP-based client to connect to the attacker-controlled RDP server (e.g., via phishing, DNS poisoning, or man-in-the-middle positioning).
3. Send crafted RDPEAR packet: Once the client connects and the dynamic virtual channel (DRDYNVC) is established, send a malicious RDPEAR packet with an inflated on-wire element count in the NDR array. The PoC uses a Key.reserved3.count value of 0x100 while Key.Hints is set to 0x8, causing the buffer (sized for 8 bytes) to be overwritten with 256 bytes of attacker-controlled data.
4. Trigger heap buffer overflow: The ndr_read_uconformant_array function reads the attacker-supplied count from the stream and writes past the end of the heap-allocated buffer in ndr_read_uint8Array, corrupting adjacent heap memory.
5. Achieve DoS or code execution: Depending on heap layout and allocator behavior, the overflow may crash the FreeRDP client process (DoS) or, with further exploitation techniques (heap grooming), potentially achieve arbitrary code execution on the client system (GitHub Advisory).

• Network: Unexpected or unsolicited RDP connection attempts from unknown servers; FreeRDP client connections to untrusted or newly observed RDP server IP addresses; anomalous RDPEAR/DRDYNVC channel traffic with unusually large element count fields in NDR-encoded packets.
• Process: FreeRDP client process (xfreerdp, wfreerdp, etc.) crashing unexpectedly or producing AddressSanitizer-style abort messages referencing ndr_read_uint8 or ndr_read_uconformant_array; unexpected child processes spawned from the FreeRDP client.
• Logs: Application crash logs or core dumps from FreeRDP client processes; system logs showing segmentation faults or heap corruption errors originating from channels/rdpear/common/ndr.c; crash reports referencing stack frames in rdpear_kerb_DecryptApReply, rdpear_decode_payload, or rdpear_on_data_received.
• File System: Unexpected core dump files in the working directory of the FreeRDP client process following an RDP session.

Upgrade FreeRDP to version 3.20.1 or later, which includes the fix adding proper bounds checks for itemSize in the RDPEAR NDR array reader (commit referenced in PR #12127). Red Hat Enterprise Linux users should apply the relevant errata: RHSA-2026:3068 (RHEL 10), RHSA-2026:4121 (RHEL 10.0 EUS), and RHSA-2026:19033. As a network-level workaround, restrict FreeRDP client connections to trusted RDP servers only, and avoid connecting to unknown or untrusted RDP endpoints. Monitor for FreeRDP client crashes that may indicate exploitation attempts (FreeRDP Release, Red Hat Bugzilla).

The vulnerability was one of nine CVEs (CVE-2026-22851 through CVE-2026-22859) disclosed simultaneously by FreeRDP on January 14, 2026, all credited to researcher ehdgks0627 for code review and testing. Red Hat issued multiple errata addressing the issue across RHEL 10 variants, and downstream distributions including SUSE, openSUSE, Fedora, Ubuntu, AlmaLinux, Rocky Linux, and Debian also released updated packages. The vulnerability received coverage in Linux security news outlets and was included in CISA's weekly vulnerability summary for the week of January 12, 2026 (FreeRDP Release, Red Hat Bugzilla).