CVE-2026-22857: 
NixOS vulnerability analysis and mitigation

CVE-2026-22857 is a heap use-after-free vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol. The flaw exists in the irp_thread_func function within the serial channel client code, where an I/O Request Packet (IRP) is freed by irp->Complete() and then accessed again on the error path via irp->Discard(). All FreeRDP versions prior to 3.20.1 are affected; FreeRDP-based servers are not impacted. It was disclosed on January 14, 2026, with a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 6.8 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a CWE-416 (Use After Free) condition in channels/serial/client/serial_main.c. In irp_thread_func, the call to data->irp->Complete(data->irp) internally invokes irp_complete(), which calls irp_free() and deallocates the IRP heap object. If rdpdr_send() fails, irp_complete returns an error and the function proceeds to execute data->irp->Discard(data->irp) on the now-freed pointer, triggering the use-after-free. Exploitation requires the attacker to control a malicious RDP server, enable serial redirection on the connecting client, and force the RDPDR channel send to fail (e.g., by closing the RDPDR channel or dropping the response). A proof-of-concept with AddressSanitizer output demonstrating the heap-use-after-free has been published in the GitHub Security Advisory (GitHub Advisory).

A malicious RDP server can trigger a client-side heap use-after-free, resulting in application crash (denial of service) or potential arbitrary code execution with the privileges of the FreeRDP process, depending on heap layout and allocator behavior. All three security pillars are affected: confidentiality, integrity, and availability. Only FreeRDP-based clients are impacted; FreeRDP-based servers and Proxy (except CVE-2026-22858) are not affected (GitHub Advisory, FreeRDP Release).

A proof-of-concept exploit scenario is documented in the GitHub Security Advisory, including AddressSanitizer output confirming the heap-use-after-free condition. The CVSS v4.0 exploit maturity is rated as PROOF_OF_CONCEPT. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.042% (0.000420), indicating low current exploitation probability (GitHub Advisory).

1. Set up a malicious RDP server: Deploy a rogue RDP server (e.g., a modified FreeRDP server or custom implementation) that the target client will connect to.
2. Induce serial redirection: Ensure the victim FreeRDP client connects with serial redirection enabled (e.g., using the /serial command-line flag), which activates the vulnerable serial_main.c code path.
3. Trigger IRP processing: Once the client connects, the server sends an IRP (I/O Request Packet) to the client via the RDPDR channel, causing irp_thread_func to execute on the client side.
4. Force RDPDR send failure: Cause rdpdr_send() to fail by closing the RDPDR channel or dropping the server-side response. This causes irp_complete() to return an error after freeing the IRP.
5. Trigger use-after-free: The error path in irp_thread_func executes data->irp->Discard(data->irp) on the already-freed IRP pointer, triggering the heap use-after-free condition.
6. Achieve impact: Depending on heap layout, this results in a crash (DoS) or, with heap grooming techniques, potential arbitrary code execution in the context of the FreeRDP client process (GitHub Advisory).

• Process: FreeRDP client process (xfreerdp, wfreerdp, etc.) crashing unexpectedly, particularly when serial redirection is enabled; crash dumps referencing irp_thread_func in serial_main.c.
• Logs: Application crash logs or core dumps showing stack traces involving irp_thread_func, irp_complete, irp_free, or rdpdr_send in FreeRDP binaries.
• Network: Unexpected or abrupt RDPDR channel closures from the RDP server side during an active session with serial redirection; connections to unknown or untrusted RDP server endpoints.
• File System: Core dump files (e.g., core.*) generated by the FreeRDP client process in the working directory or /var/crash/.

Upgrade FreeRDP to version 3.20.1 or later, which contains the fix for this vulnerability along with eight other CVEs (CVE-2026-22851 through CVE-2026-22859) discovered by researcher ehdgks0627 (FreeRDP Release). As a workaround, disable serial redirection in FreeRDP client configurations to prevent the vulnerable code path from being triggered. Additionally, restrict RDP client connections to trusted, known-good RDP servers and implement network segmentation to limit exposure. Linux distribution packages (Fedora, SUSE, openSUSE, Ubuntu, Mageia, Debian) have also released updated packages incorporating the fix (Red Hat Bugzilla).

The vulnerability was part of a batch of nine medium-severity CVEs (CVE-2026-22851 through CVE-2026-22859) disclosed simultaneously by the FreeRDP project on January 14, 2026, credited to researcher ehdgks0627 for code review and testing. Red Hat tracked the issue via Bugzilla and assessed it as medium severity for their products. Multiple Linux distributions including SUSE, openSUSE, Fedora, Ubuntu, Mageia, and Debian issued security advisories and updated packages in the weeks following disclosure. The vulnerability received routine coverage from Linux security news aggregators and vulnerability tracking services (FreeRDP Release, Red Hat Bugzilla).