CVE-2026-22854: 
NixOS vulnerability analysis and mitigation

CVE-2026-22854 is a heap-based buffer overflow vulnerability in FreeRDP's drive read functionality (drive_process_irp_read), classified as CWE-122. It affects all FreeRDP versions prior to 3.20.1 and was disclosed on January 14, 2026, by researcher ehdgks0627 via the FreeRDP GitHub security advisory program. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 6.8 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an integer overflow and missing upper-bound check in drive_process_irp_read (CWE-122). The function reads a Length value directly from the incoming IRP (I/O Request Packet) via Stream_Read_UINT32(irp->input, Length) and uses it to size a read into an IRP output stream buffer initially allocated at only 256 bytes via StreamPool_Take. The capacity check Stream_EnsureRemainingCapacity(irp->output, Length + 4) can be bypassed when Length + 4 overflows a UINT32, causing the check to pass incorrectly. Subsequently, drive_file_read passes the attacker-controlled Length directly to ReadFile, writing beyond the 256-byte heap buffer and corrupting adjacent heap memory. A proof-of-concept AddressSanitizer trace demonstrating a WRITE of size 1000 bytes past the allocated region is included in the advisory (GitHub Advisory).

A malicious RDP server can trigger a client-side heap buffer overflow during an active RDP session, leading to a crash (denial of service) and potential arbitrary code execution depending on heap layout and allocator behavior. The vulnerability affects confidentiality, integrity, and availability at a high level. Only FreeRDP-based clients are affected; FreeRDP-based servers are not impacted by this specific issue (GitHub Advisory, FreeRDP Release).

A proof-of-concept exploit is publicly referenced in the GitHub security advisory, consisting of a crafted RDPDR drive device read request with a Length value exceeding the default IRP output stream size. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.042%, indicating low but non-zero probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. CVSS v4.0 exploit maturity is rated as PROOF_OF_CONCEPT (GitHub Advisory).

1. Set up a malicious RDP server: Deploy a rogue RDP server (e.g., a modified FreeRDP server or custom implementation) that supports the RDPDR (Remote Desktop Protocol Device Redirection) channel and drive sharing.
2. Lure the victim client: Convince a user running a vulnerable FreeRDP client (version ≤ 3.20.0) to connect to the malicious server, for example via phishing or a man-in-the-middle attack on an existing RDP session.
3. Negotiate drive redirection: Ensure the client has drive redirection enabled (the /drive option in FreeRDP), so the RDPDR channel is established and the drive device is registered.
4. Send a crafted IRP read request: Over the RDPDR channel, send a malicious Device I/O Request (IRP) of type IRP_MJ_READ with a Length field set to a value greater than 252 (to overflow the 256-byte buffer) or crafted to trigger the UINT32 integer overflow in the capacity check (e.g., Length = 0xFFFFFFFC so Length + 4 = 0, bypassing Stream_EnsureRemainingCapacity).
5. Trigger heap overflow: The client's drive_process_irp_read function reads the attacker-controlled Length, fails to properly resize the output buffer, and calls drive_file_read → ReadFile with the oversized length, writing beyond the 256-byte heap allocation and corrupting adjacent heap memory.
6. Achieve DoS or code execution: Depending on heap layout, the overflow may crash the FreeRDP client process (DoS) or, with heap grooming, enable arbitrary code execution in the context of the client user (GitHub Advisory).

• Network: Unexpected or unsolicited RDP connections to unknown or untrusted servers; RDPDR channel traffic containing IRP read requests with anomalously large Length values (e.g., > 256 bytes or near UINT32_MAX).
• Process: FreeRDP client process (xfreerdp, wfreerdp, etc.) crashing unexpectedly or exiting with a segmentation fault or heap corruption error during an RDP session with drive redirection enabled.
• Logs: AddressSanitizer or system crash logs referencing drive_process_irp_read, drive_file_read, or StreamPool_Take in FreeRDP stack traces; core dump files generated by the FreeRDP client process.
• File System: Unexpected core dump files (e.g., core.*) in the working directory of the FreeRDP client; crash reports referencing drive_main.c or irp.c source files.

The primary remediation is to upgrade FreeRDP to version 3.20.1 or later, which contains the fix (commit 3da3195) (FreeRDP Release). As a workaround, disable drive redirection in FreeRDP client configurations (remove the /drive option) to prevent the vulnerable code path from being triggered. Red Hat has issued multiple errata addressing this vulnerability across RHEL 7 through RHEL 10 (RHSA-2026:6340, RHSA-2026:6727, RHSA-2026:6743, RHSA-2026:6799, RHSA-2026:6918, and others) (Red Hat Bugzilla). Organizations should also ensure FreeRDP clients only connect to trusted RDP servers to reduce exposure to server-side attacks.

The vulnerability was part of a batch of nine CVEs (CVE-2026-22851 through CVE-2026-22859) disclosed simultaneously in the FreeRDP 3.20.1 release, all credited to researcher ehdgks0627 for code review and testing (FreeRDP Release). The advisory was rated "Moderate" severity by the FreeRDP project despite the high CVSS v3.1 score, reflecting the requirement for user interaction (connecting to a malicious server). Multiple Linux distributions including Red Hat, SUSE, openSUSE, Ubuntu, Fedora, AlmaLinux, Rocky Linux, Mageia, and Amazon Linux 2 issued security updates in the weeks following disclosure.