CVE-2026-23531: 
NixOS vulnerability analysis and mitigation

CVE-2026-23531 is a heap-based buffer overflow vulnerability in FreeRDP's ClearCodec decompression logic that allows a malicious RDP server to trigger a client-side crash or potential remote code execution. It affects all FreeRDP versions prior to 3.21.0 and was disclosed on January 19, 2026, by researcher ehdgks0627. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow). In libfreerdp/codec/clear.c (lines 1139–1145), when a glyphData buffer is present during ClearCodec decompression, clear_decompress calls freerdp_image_copy_no_overlap using destination rectangle coordinates (nXDst, nYDst, nWidth, nHeight) sourced directly from the RDPGFX WireToSurface1 PDU without validating them against the target surface dimensions. The destRect values are only checked for ordering (left < right, top < bottom) in rdpgfx_read_rect16 but are never clamped to the surface bounds before being forwarded through gdi_SurfaceCommand_ClearCodec into clear_decompress. Since freerdp_image_copy_no_overlap performs no internal bounds checking, a crafted destRect that extends beyond the allocated surface buffer results in out-of-bounds reads and writes on the client heap. A public AddressSanitizer-confirmed proof-of-concept is included in the GitHub Security Advisory (GitHub Advisory, Vulnerable Code).

A malicious or compromised RDP server can send crafted RDPGFX surface update packets to any connecting FreeRDP client, triggering a heap buffer overflow that at minimum causes an application crash (denial of service). Depending on heap layout and allocator behavior, the out-of-bounds write may enable heap corruption sufficient for remote code execution on the client system, with full confidentiality, integrity, and availability impact. No user interaction beyond connecting to a malicious server is required, making this exploitable in scenarios where users connect to untrusted or attacker-controlled RDP endpoints (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept exploit demonstrating the heap buffer overflow via AddressSanitizer output is publicly available in the GitHub Security Advisory (GitHub Advisory). The CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT. As of the time of reporting, there is no evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.088%, indicating low but non-zero probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Set up a malicious RDP server: Configure a rogue RDP server (e.g., using a modified FreeRDP server build or a custom RDP server implementation) capable of sending crafted RDPGFX WireToSurface1 PDUs with ClearCodec-encoded data.
2. Lure the target client: Trick a user running a vulnerable FreeRDP client (version ≤ 3.20.2) into connecting to the malicious server, for example via a phishing link, a malicious .rdp file, or a man-in-the-middle attack on an existing RDP session.
3. Negotiate RDPGFX channel: During the RDP connection handshake, negotiate the Graphics Pipeline Extension (RDPGFX) dynamic virtual channel, which enables ClearCodec surface updates.
4. Send crafted WireToSurface1 PDU: Transmit a WireToSurface1 PDU containing a ClearCodec-encoded bitmap with a glyph index present (CLEARCODEC_FLAG_GLYPH_INDEX set) and a destRect whose coordinates (left, top, right, bottom) pass ordering validation but extend beyond the allocated surface buffer dimensions.
5. Trigger heap buffer overflow: The client's clear_decompress function calls freerdp_image_copy_no_overlap with the unvalidated out-of-bounds coordinates, causing heap memory beyond the surface buffer to be read from or written to.
6. Achieve denial of service or code execution: At minimum, the client process crashes. With careful heap grooming (controlling allocator layout around the surface buffer), an attacker may overwrite adjacent heap metadata or function pointers to redirect execution (GitHub Advisory).

• Network: Unexpected or unsolicited RDP connections from unknown servers; RDPGFX channel traffic containing anomalously large or out-of-range destRect values in WireToSurface1 PDUs.
• Process: FreeRDP client process (xfreerdp, wfreerdp, sdl-freerdp) crashing unexpectedly or producing AddressSanitizer-style abort messages referencing clear_decompress, freerdp_image_copy_no_overlap, or generic_image_copy_bgrx32_bgrx32.
• Logs: Application crash logs or core dumps from FreeRDP client processes; system logs showing abnormal termination of RDP client sessions shortly after RDPGFX channel establishment.
• File System: Unexpected core dump files (e.g., core.*) in the working directory of the FreeRDP client process following an RDP session.

Upgrade FreeRDP to version 3.21.0 or later, which contains the fix for this vulnerability (FreeRDP Release). Red Hat has issued patches for RHEL 7, 8, 9, and 10 via errata RHSA-2026:2048, RHSA-2026:2081, RHSA-2026:2222, RHSA-2026:2714, and related advisories (Red Hat Bugzilla). As a workaround prior to patching, restrict FreeRDP client connections to trusted, verified RDP servers only, and avoid connecting to unknown or untrusted RDP endpoints. Fedora, SUSE, Ubuntu, openSUSE, AlmaLinux, Rocky Linux, Amazon Linux 2, Mageia, Debian, and Oracle Linux have also released updated packages.

The vulnerability was reported by researcher ehdgks0627 and acknowledged by the FreeRDP maintainer (akallabeth) in the 3.21.0 release notes, which described it as one of several medium-severity client-side vulnerabilities fixed in the release (FreeRDP Release). Red Hat classified the issue as high severity and issued multiple errata across RHEL versions within weeks of disclosure (Red Hat Bugzilla). Coverage appeared on Linux security news aggregators and German Linux security site pro-linux.de, reflecting broad distribution-level attention but no significant social media controversy.