CVE-2026-22859: 
NixOS vulnerability analysis and mitigation

CVE-2026-22859 is a heap buffer overflow (out-of-bounds read) vulnerability in the URBDRC client of FreeRDP, a free implementation of the Remote Desktop Protocol. The flaw exists in all FreeRDP versions prior to 3.20.1, where server-supplied MSUSB_INTERFACE_DESCRIPTOR values are used as array indices without bounds checking in libusb_udev_complete_msconfig_setup, enabling an out-of-bounds read. It was disclosed on January 14, 2026, and fixed in FreeRDP 3.20.1 released the same day. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 5.6 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-125 (Out-of-bounds Read) and CWE-129 (Improper Validation of Array Index). In data_transfer.c, TS_URB_SELECT_CONFIGURATION data is parsed directly from the RDP channel stream via msusb_msconfig_read(), and the resulting MSUSB_INTERFACE_DESCRIPTOR fields InterfaceNumber and AlternateSetting are passed without validation to libusb_udev_complete_msconfig_setup() in libusb_udevice.c. This function then uses these untrusted values to index into LibusbConfig->interface[] and LibusbInterface->altsetting[] arrays, triggering a heap buffer overflow when the values exceed the actual device interface/altsetting counts. A public proof-of-concept is available in the GitHub security advisory, including a full AddressSanitizer trace demonstrating the heap-buffer-overflow at libusb_udevice.c:621 (GitHub Advisory).

A malicious or compromised RDP server can exploit this vulnerability by sending a crafted TS_URB_SELECT_CONFIGURATION message with oversized InterfaceNumber or AlternateSetting values to a connecting FreeRDP client with USB redirection enabled. This can result in memory disclosure (reading sensitive data from the client process heap) or a client crash causing denial of service; depending on heap layout and allocator behavior, heap corruption with potential code execution risk is also possible. Only FreeRDP-based clients are affected; FreeRDP-based servers are not impacted (GitHub Advisory, FreeRDP Release).

A proof-of-concept exploit is publicly available in the FreeRDP GitHub security advisory, demonstrating the heap buffer overflow with AddressSanitizer output. The vulnerability requires no authentication and no privileges on the attacker's side — only that the victim client connects to a malicious RDP server with USB redirection (URBDRC) enabled. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.042% (low probability of exploitation in the near term), and the vulnerability is not listed in the CISA KEV catalog. CVSS v4.0 exploit maturity is rated as Proof-of-Concept (GitHub Advisory, Red Hat Bugzilla).

1. Set up a malicious RDP server: Configure a rogue RDP server (e.g., using a modified FreeRDP server or custom RDP implementation) capable of sending crafted dynamic virtual channel data over the URBDRC channel.
2. Lure the victim to connect: Induce a FreeRDP client (version ≤ 3.20.0) with USB redirection enabled (/usb or URBDRC plugin active) to connect to the malicious server.
3. Trigger USB configuration exchange: Once the client connects and the URBDRC dynamic virtual channel is established, send a crafted TS_URB_SELECT_CONFIGURATION message via the channel stream.
4. Craft malicious MSUSB_INTERFACE_DESCRIPTOR: Set NumInterfaces=1 and provide an interface descriptor where InterfaceNumber or AlternateSetting is set to a value larger than the actual device's interface or altsetting count (e.g., a large integer).
5. Trigger out-of-bounds read: The FreeRDP client parses the descriptor without bounds checking and passes the untrusted index to libusb_udev_complete_msconfig_setup(), which indexes LibusbConfig->interface[] or LibusbInterface->altsetting[] out of bounds, causing a heap buffer overflow read.
6. Achieve DoS or memory disclosure: The OOB read causes the client to crash (DoS) or, depending on heap layout, may expose heap memory contents to the server or enable further exploitation (GitHub Advisory).

• Process: Unexpected crash or abort of the FreeRDP client process (xfreerdp, wfreerdp, etc.) during or shortly after RDP connection establishment with USB redirection enabled.
• Logs: AddressSanitizer output referencing libusb_udevice.c:621 (libusb_udev_complete_msconfig_setup) or data_transfer.c:554 (urb_select_configuration) in application crash logs or core dumps.
• Network: RDP connections to unfamiliar or untrusted server IP addresses, particularly where the URBDRC (USB redirection) dynamic virtual channel is negotiated; unexpected TS_URB_SELECT_CONFIGURATION messages with anomalous NumInterfaces or descriptor field values in network captures.
• File System: Core dump files generated by the FreeRDP client process in the working directory or /var/crash/, indicating abnormal termination.

Upgrade FreeRDP to version 3.20.1 or later, which includes bounds checking on MSUSB_INTERFACE_DESCRIPTOR values before they are used as array indices (FreeRDP Release). Red Hat has issued patches for RHEL 7 through 10 via multiple errata (RHSA-2026:3067, RHSA-2026:3068, RHSA-2026:3334, and others); users of affected RHEL versions should apply the relevant errata (Red Hat Bugzilla). As an interim workaround for systems that cannot be updated immediately, disable USB redirection in FreeRDP (do not use the /usb flag or URBDRC plugin) and restrict RDP client connections to trusted servers only using network-level controls.

CVE-2026-22859 was one of nine medium-severity vulnerabilities disclosed by the FreeRDP project on January 14, 2026, credited to security researcher ehdgks0627 for code review and testing. The FreeRDP maintainer (akallabeth) described the release as a "new years cleanup release" that addressed these findings. Multiple Linux distributions including Red Hat, SUSE, openSUSE, Ubuntu, Fedora, AlmaLinux, Rocky Linux, Oracle Linux, Amazon Linux, Debian, and Mageia have issued security advisories and updated packages. No significant independent researcher commentary or social media discussion beyond routine CVE tracking has been observed (FreeRDP Release, Red Hat Bugzilla).