CVE-2026-22858: 
NixOS vulnerability analysis and mitigation

CVE-2026-22858 is a global buffer overflow vulnerability in FreeRDP's Base64 decoding path (crypto_base64_decode), affecting all versions prior to 3.20.1. The flaw was discovered during RDP fuzzing and disclosed on January 14, 2026, by researcher ehdgks0627 (GitHub Advisory). It affects FreeRDP-based clients and the FreeRDP proxy component (for load-balanced server redirection scenarios); FreeRDP-based servers are not affected (FreeRDP Release). The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 5.6 (Medium) (Red Hat CVE).

The root cause is implementation-defined char signedness behavior (CWE-758) combined with an out-of-bounds read (CWE-125) in libfreerdp/crypto/base64.c. On Arm/AArch64 builds, plain char is treated as unsigned, so the intended guard c <= 0 — designed to reject negative values and NUL — is legally optimized by the compiler into a simple c != 0 check. This allows non-ASCII bytes in the range 0x80–0xFF to bypass the range restriction and be used as an index into a global Base64 lookup table, causing an out-of-bounds read. The vulnerability is triggered during processing of a server redirection PDU (rdp_redirection_read_base64_wchar → crypto_base64_decode), meaning a malicious RDP server can deliver a crafted packet to exploit a connecting client (GitHub Advisory). The fix involves explicitly casting the character to signed char before comparison or enforcing -fsigned-char at the compiler level (FreeRDP Release).

A malicious RDP server can trigger a client-side global buffer overflow, resulting in a crash (denial of service) and potential information disclosure from adjacent global memory regions. The confidentiality and availability impacts are both rated HIGH under CVSS v3.1, with no integrity impact (GitHub Advisory). The vulnerability specifically affects FreeRDP clients and the FreeRDP proxy on Arm/AArch64 architectures; x86/x64 systems where char defaults to signed are not affected by this specific code path (Red Hat CVE).

A proof-of-concept (PoC) AddressSanitizer trace is included in the official GitHub Security Advisory, demonstrating the global-buffer-overflow in base64_decode_char (GitHub Advisory). The CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT. No evidence of active in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.044%, indicating a low current probability of exploitation (Red Hat CVE). Exploitation requires the victim client to connect to a malicious or compromised RDP server, and the issue is architecture-specific (Arm/AArch64).

1. Set up a malicious RDP server: The attacker deploys a rogue RDP server (or compromises a legitimate one) capable of sending crafted server redirection PDUs during the RDP session establishment phase.
2. Lure the victim client: The attacker tricks a FreeRDP-based client running on an Arm/AArch64 system (version ≤ 3.20.0) into connecting to the malicious server, e.g., via phishing, DNS poisoning, or a compromised load balancer.
3. Send a crafted redirection PDU: During the connection, the server sends a Server Redirection PDU containing Base64-encoded data with non-ASCII bytes (0x80–0xFF) embedded in the targetCert or related fields processed by rdp_redirection_read_base64_wchar.
4. Trigger out-of-bounds read: The FreeRDP client passes the malicious Base64 data to crypto_base64_decode → base64_decode → base64_decode_char. On AArch64, the compiler-optimized guard (c != 0 instead of c <= 0) allows the non-ASCII byte to be used as an array index into the global lookup table, causing an out-of-bounds read.
5. Achieve DoS or information leak: The out-of-bounds access crashes the client process (DoS) or may expose adjacent global memory contents, depending on the specific byte values and memory layout (GitHub Advisory).

• Process: FreeRDP client process (xfreerdp, wfreerdp, or similar) crashing unexpectedly, particularly on Arm/AArch64 systems, with SIGABRT or SIGSEGV signals during or shortly after RDP server connection.
• Logs: AddressSanitizer output (if ASan-enabled builds are used) referencing base64_decode_char in libfreerdp/crypto/base64.c:406 and crypto_base64_decode in the stack trace; application crash logs from FreeRDP clients.
• Network: Unexpected or unsolicited RDP Server Redirection PDUs received from an RDP server, especially from servers not previously known to use load balancing or redirection; connections to unfamiliar RDP endpoints.
• File System: Core dump files generated by the FreeRDP client process in the working directory or system crash dump location (GitHub Advisory).

The vulnerability is fixed in FreeRDP version 3.20.1, released January 14, 2026 (FreeRDP Release). All users of FreeRDP ≤ 3.20.0 on any architecture should upgrade immediately, with particular urgency for Arm/AArch64 deployments. Red Hat has issued patches across multiple RHEL versions (7, 8, 9, 10) via errata RHSA-2026:3067, RHSA-2026:3068, RHSA-2026:3334, and several EUS/SAP advisories (Red Hat Bugzilla). As a temporary workaround where patching is not immediately possible, restrict FreeRDP client connections to trusted RDP servers only, and disable or limit RDP proxy redirection features. Organizations can also compile FreeRDP with -fsigned-char to enforce consistent char signedness as a build-level mitigation.

The vulnerability was reported by security researcher ehdgks0627, who was credited in the FreeRDP 3.20.1 release notes for uncovering multiple medium-severity vulnerabilities through code review and fuzzing (FreeRDP Release). Red Hat triaged the issue as high severity and issued patches across all supported RHEL versions within approximately six weeks of disclosure (Red Hat Bugzilla). Downstream Linux distributions including openSUSE, Fedora, AlmaLinux, Rocky Linux, Oracle Linux, Ubuntu, and Debian also issued security updates addressing this CVE. The vulnerability received coverage from security news aggregators and Linux security advisory services, though no major independent researcher commentary or significant social media discussion was observed beyond routine CVE tracking.