CVE-2026-23530: 
NixOS vulnerability analysis and mitigation

CVE-2026-23530 is a heap-based buffer overflow vulnerability in FreeRDP's planar bitmap decompression function (freerdp_bitmap_decompress_planar) that allows a malicious RDP server to trigger a client-side crash or potential arbitrary code execution. It affects all FreeRDP versions prior to 3.21.0 and was disclosed on January 19, 2026, when FreeRDP released version 3.21.0 containing the fix. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 7.7 (High) (FreeRDP Advisory, Red Hat CVE).

The root cause is a missing bounds check (CWE-122: Heap-based Buffer Overflow) in freerdp_bitmap_decompress_planar: the function passes nSrcWidth/nSrcHeight directly to planar_decompress_plane_rle without first validating them against planar->maxWidth/maxHeight. The context buffers (pTempData, rlePlanesBuffer, deltaPlanesBuffer) are sized during context initialization via freerdp_bitmap_planar_context_reset using maxPlaneSize = maxWidth * maxHeight, but the RLE decode loop writes based on the unvalidated nSrcWidth/nSrcHeight, allowing the destination pointer dstp to advance past the end of the allocated heap buffer. An attacker exploits this by acting as a malicious RDP server: sending a CreateSurface PDU with dimensions exceeding the planar context's maxWidth/maxHeight, then sending a WireToSurface1 PDU containing a planar bitmap with the RLE flag set and oversized width/height fields, causing the RLE decode loop to write out-of-bounds (FreeRDP Advisory, FreeRDP Source).

A malicious RDP server can trigger a client-side heap buffer overflow in any FreeRDP client connecting to it, resulting in a guaranteed denial of service (crash) and potential arbitrary code execution depending on heap allocator behavior and surrounding heap layout. The attack requires no user interaction and no privileges beyond network access to the client, making it fully exploitable by any server the client connects to. Successful code execution would compromise the confidentiality, integrity, and availability of the client system, and could enable lateral movement within the victim's network (FreeRDP Advisory, Red Hat CVE).

A proof-of-concept exploit is publicly available via the FreeRDP GitHub security advisory, demonstrating the heap buffer overflow with AddressSanitizer output. The EPSS score is approximately 0.095%, and there is no evidence of active in-the-wild exploitation as of the disclosure date. The vulnerability is not currently listed in the CISA KEV catalog. The CVSSv4 exploit maturity is rated as "Proof of Concept" (FreeRDP Advisory, Feedly).

1. Set up a malicious RDP server: Deploy a custom or modified RDP server (e.g., using a framework that allows crafting arbitrary RDP PDUs) that the target FreeRDP client will connect to.
2. Establish RDP connection: Lure or wait for a FreeRDP client (version ≤ 3.20.2) to connect to the malicious server. No credentials or special privileges are required on the server side.
3. Send oversized CreateSurface PDU: Transmit a CreateSurface PDU specifying surface dimensions (width/height) that exceed the planar context's maxWidth/maxHeight values established during the client's codec initialization.
4. Craft malicious WireToSurface1 PDU: Construct a WireToSurface1 PDU containing a planar bitmap with the RLE flag set and the NA (No Alpha) bit set (RGB path), embedding width/height values consistent with the oversized surface dimensions.
5. Trigger heap OOB write: When the client processes the PDU, freerdp_bitmap_decompress_planar calls planar_decompress_plane_rle with the unvalidated nSrcWidth/nSrcHeight, causing the RLE decode loop to write beyond the bounds of pTempData/rlePlanesBuffer, resulting in a heap buffer overflow at planar.c:436.
6. Achieve DoS or code execution: The overflow causes an immediate crash (DoS) or, depending on heap layout and allocator behavior, may enable arbitrary code execution on the client system (FreeRDP Advisory).

• Process: Unexpected crash or termination of the FreeRDP client process (xfreerdp, wfreerdp, or similar) immediately after connecting to an RDP server, particularly with AddressSanitizer or crash dump output referencing planar_decompress_plane_rle or freerdp_bitmap_decompress_planar in libfreerdp/codec/planar.c.
• Logs: Application crash logs or core dumps showing stack traces involving planar_decompress_plane_rle (planar.c:436), freerdp_bitmap_decompress_planar (planar.c:951), gdi_SurfaceCommand_Planar, or rdpgfx_recv_wire_to_surface_1_pdu.
• Network: RDP traffic from an unexpected or untrusted server IP containing unusually large surface dimension values in CreateSurface or WireToSurface1 PDUs on TCP port 3389 (or configured RDP port).
• File System: Crash dump files (core dumps on Linux, minidumps on Windows) generated by the FreeRDP client process in the working directory or system crash dump location shortly after an RDP connection attempt.

Upgrade all FreeRDP installations to version 3.21.0 or later, which contains the patch adding validation of nSrcWidth/nSrcHeight against planar->maxWidth/maxHeight before RLE decode (FreeRDP Release). Downstream distributions including Red Hat (RHSA-2026:2081, RHSA-2026:2048, RHSA-2026:2222, and others), Ubuntu (USN-8004-1, USN-8105-1), Fedora, SUSE, openSUSE, Rocky Linux, AlmaLinux, Amazon Linux 2, Mageia, and Debian have released updated packages (Red Hat Errata). As an interim workaround where patching is not immediately feasible, restrict FreeRDP client connections to trusted RDP servers only and implement network controls (firewall rules, VPN) to prevent connections to untrusted RDP endpoints. Monitor for unexpected FreeRDP client crashes as a potential indicator of exploitation attempts.

The vulnerability was discovered and reported by security researcher ehdgks0627, who is credited in the FreeRDP 3.21.0 release notes for identifying multiple client-side vulnerabilities (CVE-2026-23530 through CVE-2026-23884). The FreeRDP maintainer akallabeth published the advisory and patch simultaneously on January 19, 2026. The vulnerability received broad coverage across Linux distribution security channels, with rapid patch uptake by Red Hat, Ubuntu, Fedora, SUSE, and other major distributions within days to weeks of disclosure (FreeRDP Release, FreeRDP Advisory).