CVE-2026-23532: 
NixOS vulnerability analysis and mitigation

CVE-2026-23532 is a heap-based buffer overflow vulnerability in the FreeRDP client's gdi_SurfaceToSurface graphics pipeline path. It affects all FreeRDP versions prior to 3.21.0 and was disclosed on January 19, 2026, by researcher ehdgks0627 via the FreeRDP GitHub security advisory program. A malicious RDP server can trigger a client-side heap buffer overflow, leading to denial of service (crash) and potential remote code execution depending on heap layout. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Red Hat CVE).

The root cause (CWE-122: Heap-based Buffer Overflow) lies in gdi_SurfaceToSurface within libfreerdp/gdi/gfx.c (lines 1368–1382). The destination rectangle (destRect) is clamped using MIN(UINT16_MAX, destPt->x + nWidth) and MIN(UINT16_MAX, destPt->y + nHeight), but the subsequent call to freerdp_image_copy still uses the original unclamped nWidth/nHeight values. If destPt.x + nWidth or destPt.y + nHeight exceeds the actual surface dimensions, an out-of-bounds write occurs into heap memory. An attacker exploits this by first creating a large surface (e.g., height ≥ 65535) via a CreateSurface PDU, then sending a crafted SurfaceToSurface PDU where the destination point plus copy dimensions overflow the surface boundary, triggering the overflow in freerdp_image_copy (GitHub Advisory, Vulnerable Code).

Successful exploitation allows a malicious RDP server to corrupt heap memory on the connecting client, causing an immediate application crash (denial of service). Depending on the allocator behavior and surrounding heap layout, the overflow may be leveraged for arbitrary code execution on the client system with the privileges of the FreeRDP process. This is a client-side vulnerability, meaning any user connecting to an attacker-controlled or compromised RDP server is at risk — no server-side compromise is required to affect clients (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept exploit (AddressSanitizer-confirmed heap-buffer-overflow) is publicly available in the GitHub security advisory, demonstrating a WRITE of size 4 past the allocated surface buffer (GitHub Advisory). The CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.088%, reflecting low but non-zero exploitation probability. No specific threat actor attribution has been reported (Feedly Intelligence).

1. Set up a malicious RDP server: Deploy a rogue RDP server (e.g., using a modified FreeRDP server build or custom RDP implementation) that supports the Graphics Pipeline Extension (RDPGFX channel).
2. Lure the victim client: Trick a user running a vulnerable FreeRDP client (version ≤ 3.20.2) into connecting to the malicious server, e.g., via phishing, a malicious .rdp file, or a man-in-the-middle attack.
3. Send a CreateSurface PDU: Instruct the client to allocate a large GFX surface with height ≥ 65535 pixels using a RDPGFX_CREATE_SURFACE_PDU, causing a large heap allocation in gdi_CreateSurface.
4. Craft a SurfaceToSurface PDU: Send a RDPGFX_SURFACE_TO_SURFACE_PDU where destPt.y + nHeight (or destPt.x + nWidth) exceeds the destination surface's actual height/width, while the clamped destRect passes the is_rect_valid bounds check.
5. Trigger heap overflow: The client's gdi_SurfaceToSurface function passes the unclamped nWidth/nHeight to freerdp_image_copy, which performs a memcpy writing beyond the allocated surface buffer, corrupting adjacent heap memory.
6. Achieve DoS or code execution: The overflow causes an immediate crash (DoS), or with heap grooming techniques, may overwrite heap metadata or function pointers to redirect execution flow (GitHub Advisory).

• Network: Unexpected or unsolicited RDP connections to unknown/untrusted servers; RDP traffic containing oversized RDPGFX_CREATE_SURFACE_PDU messages with height/width values near UINT16_MAX (65535).
• Process: FreeRDP client process (xfreerdp, wfreerdp, sdl-freerdp) crashing unexpectedly or producing AddressSanitizer/core dump output referencing gdi_SurfaceToSurface, freerdp_image_copy, or generic_image_copy_no_overlap_memcpy.
• Logs: Application crash logs or core dumps with stack traces showing gdi_SurfaceToSurface → freerdp_image_copy → memcpy at the point of failure; ASan reports indicating heap-buffer-overflow on a surface data buffer.
• File System: Unexpected core dump files (e.g., core.*) in the working directory of the FreeRDP client process following an RDP session to an external server.

The primary remediation is to upgrade FreeRDP to version 3.21.0 or later, which contains the fix that properly clamps nWidth/nHeight before passing them to freerdp_image_copy (FreeRDP Release). Red Hat has issued multiple errata addressing this vulnerability across RHEL 7–10 (RHSA-2026:2048, RHSA-2026:2081, RHSA-2026:2222, and others) (Red Hat Bugzilla). Fedora, SUSE, Ubuntu, openSUSE, AlmaLinux, Rocky Linux, Amazon Linux 2, Mageia, and Debian have also released updated packages. As a workaround where patching is not immediately possible, restrict FreeRDP clients to connecting only to trusted, known-good RDP servers and avoid connecting to untrusted or externally hosted RDP endpoints.

The vulnerability was reported by researcher ehdgks0627 and acknowledged by the FreeRDP maintainer (akallabeth) in the 3.21.0 release notes as one of several medium-severity client-side vulnerabilities fixed in that release (FreeRDP Release). Red Hat classified the issue as high severity and tracked it through multiple errata across all supported RHEL versions. Coverage appeared on Linux security news aggregators (linuxsecurity.com, pro-linux.de, linuxcompatible.org) and vulnerability databases (VulDB, vulners.com) shortly after disclosure, reflecting broad awareness in the Linux/open-source security community.