CVE-2026-22855: 
NixOS vulnerability analysis and mitigation

CVE-2026-22855 is a heap out-of-bounds read vulnerability in FreeRDP's smartcard SetAttrib processing path, specifically in the smartcard_unpack_set_attrib_call function. It affects all FreeRDP versions prior to 3.20.1 and was disclosed on January 14, 2026, by researcher ehdgks0627. The flaw arises when cbAttrLen does not match the actual NDR buffer length, leading to a heap buffer overflow on the client side. It carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 5.6 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper input validation (CWE-20) and an out-of-bounds read (CWE-125) in libfreerdp/utils/smartcard_pack.c. The function smartcard_unpack_set_attrib_call reads cbAttrLen from the RDP stream, then calls smartcard_ndr_read() with a minimum length of 0, which allocates pbAttr based on the NDR-encoded length rather than cbAttrLen. Because there is no validation that the NDR length equals cbAttrLen, a subsequent call to SCardSetAttrib uses the larger cbAttrLen value as the buffer size, causing a read beyond the allocated heap region. The fix is to pass call->cbAttrLen as the minimum length to smartcard_ndr_read, ensuring the allocated buffer is at least that size. Exploitation requires smartcard redirection to be enabled on the FreeRDP client and the client connecting to a malicious or man-in-the-middle RDP server (GitHub Advisory).

A malicious RDP server (or an attacker performing a man-in-the-middle attack) can trigger a client-side heap buffer overflow, resulting in a crash (denial of service) and potential heap memory disclosure. Confidentiality impact is rated HIGH due to the risk of reading sensitive heap contents, and availability impact is also HIGH due to the crash potential. Only FreeRDP-based clients with smartcard redirection enabled are affected; FreeRDP-based servers are not impacted (GitHub Advisory, FreeRDP Release).

A proof-of-concept exploit is publicly available via the GitHub Security Advisory, demonstrating the heap buffer overflow using AddressSanitizer output. There is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.042%, indicating low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify FreeRDP clients (version ≤ 3.20.0) with smartcard redirection enabled (/smartcard option or equivalent configuration).
2. Set up malicious RDP server or MITM position: Deploy a rogue RDP server or intercept an existing RDP session between a FreeRDP client and a legitimate server.
3. Craft malicious SetAttrib request: Construct an RDP smartcard SetAttrib request where cbAttrLen is set to a large value (e.g., several hundred bytes), but the NDR-encoded pbAttr buffer contains a much smaller actual payload (e.g., 12 bytes).
4. Send the crafted packet: Deliver the malformed packet to the FreeRDP client during an active RDP session with smartcard redirection active.
5. Trigger heap out-of-bounds read: The client's smartcard_unpack_set_attrib_call allocates a small buffer based on the NDR length, then SCardSetAttrib reads cbAttrLen bytes from it, reading beyond the allocated heap region — causing a crash (DoS) or leaking heap memory contents (GitHub Advisory).

• Process: FreeRDP client process (xfreerdp, wlfreerdp, etc.) crashing unexpectedly during an RDP session with smartcard redirection enabled; AddressSanitizer reports referencing smartcard_array_dump or smartcard_unpack_set_attrib_call in crash logs.
• Logs: Application crash logs or core dumps from FreeRDP processes showing stack traces involving smartcard_SetAttrib_Decode, smartcard_irp_device_control_decode, or smartcard_process_irp.
• Network: Unexpected or anomalous RDP traffic containing SetAttrib smartcard requests with mismatched cbAttrLen and NDR buffer lengths from an untrusted or unknown RDP server IP.
• File System: Core dump files generated by FreeRDP client processes in working directories, potentially containing heap memory contents (GitHub Advisory).

Upgrade FreeRDP to version 3.20.1 or later, which fixes the vulnerability by passing call->cbAttrLen as the minimum length to smartcard_ndr_read, ensuring the allocated buffer is always at least as large as the declared attribute length. Red Hat has issued multiple errata addressing this issue across RHEL 7 through 10 (RHSA-2026:3067, RHSA-2026:3068, RHSA-2026:3334, and others). As a workaround until patching is complete, disable smartcard redirection in FreeRDP client configurations and restrict RDP connections to trusted servers only (GitHub Advisory, Red Hat Bugzilla, FreeRDP Release).

The vulnerability was part of a batch of nine CVEs (CVE-2026-22851 through CVE-2026-22859) discovered by researcher ehdgks0627 and disclosed by the FreeRDP project in the 3.20.1 release notes. Red Hat responded promptly with multiple errata across all supported RHEL versions. Downstream Linux distributions including openSUSE, Ubuntu, AlmaLinux, Rocky Linux, Oracle Linux, Fedora, Mageia, and Debian also issued security updates. Coverage appeared on Linux security news aggregators and community forums (FreeRDP Release, Red Hat Bugzilla).