CVE-2026-23533: 
NixOS vulnerability analysis and mitigation

CVE-2026-23533 is a heap-based buffer overflow vulnerability in FreeRDP's RDPGFX ClearCodec decode path, specifically in the clear_decompress_residual_data function. A malicious RDP server can send crafted residual data that causes out-of-bounds writes during color output processing on the client side. All FreeRDP versions prior to 3.21.0 are affected. The vulnerability was disclosed on January 19, 2026, with a patch released the same day in FreeRDP 3.21.0. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a heap-based buffer overflow (CWE-122) in libfreerdp/codec/clear.c. In the clear_resize_buffer function (line 336), the size calculation ((width + 16) * (height + 16) * FreeRDPGetBytesPerPixel(clear->format)) uses 32-bit arithmetic that can overflow when the server-controlled nWidth and nHeight values approach 0xFFFF, resulting in an undersized heap allocation. Subsequently, the write loop in clear_decompress_residual_data (lines 268–281) iterates up to runLengthFactor times, writing color data past the end of the allocated buffer. The attack is triggered via a WIRE_TO_SURFACE_PDU_1 packet routed through rdpgfx_recv_wire_to_surface_1_pdu → rdpgfx_decode → the ClearCodec path, requiring no user interaction or authentication beyond a client connecting to a malicious server. The fix involves using UINT64 for the size and TempSize variables to prevent integer overflow (GitHub Advisory, FreeRDP Source).

Successful exploitation causes a client-side heap buffer overflow, resulting in application crash (Denial of Service) and potential heap corruption. Depending on the allocator behavior and surrounding heap layout, an attacker may achieve arbitrary code execution on the connecting client system. Since the attack originates from a malicious or compromised RDP server, users connecting to untrusted RDP endpoints are at risk of full client-side compromise, including confidentiality, integrity, and availability impacts (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept exploit (AddressSanitizer crash reproducer) is publicly available in the GitHub Security Advisory, demonstrating the heap-buffer-overflow condition. The vulnerability requires no authentication, no user interaction, and is exploitable over the network, making it highly accessible to attackers. The EPSS score is approximately 0.093%, indicating a currently low but non-negligible probability of exploitation in the wild. There is no evidence of active in-the-wild exploitation or CISA KEV catalog listing as of the time of this report. No specific threat actor attribution has been identified (GitHub Advisory, Feedly).

1. Set up a malicious RDP server: Deploy a rogue RDP server (e.g., a modified FreeRDP server build or a custom implementation) that supports the RDPGFX Graphics Pipeline Extension and ClearCodec.
2. Lure or redirect a client: Convince a target user running a vulnerable FreeRDP client (version ≤ 3.20.2) to connect to the malicious server, or perform a man-in-the-middle attack on an existing RDP session.
3. Negotiate RDPGFX channel: During the RDP session setup, negotiate the rdpgfx dynamic virtual channel to enable the Graphics Pipeline Extension.
4. Craft a malicious WIRE_TO_SURFACE_PDU_1: Send a WIRE_TO_SURFACE_PDU_1 packet using the ClearCodec codec type, with nWidth and nHeight values near 0xFFFF to trigger integer overflow in clear_resize_buffer, causing an undersized heap allocation.
5. Trigger out-of-bounds write: Include residual data with a runLengthFactor value that causes the write loop in clear_decompress_residual_data to iterate beyond the allocated buffer boundary, corrupting adjacent heap memory.
6. Achieve DoS or code execution: The overflow causes an immediate crash (DoS) or, with heap layout manipulation, may enable arbitrary code execution on the client system (GitHub Advisory).

• Process: FreeRDP client process (xfreerdp, wfreerdp, or similar) crashing unexpectedly, particularly after connecting to an external or untrusted RDP server; crash dumps referencing clear_decompress_residual_data, FreeRDPWriteColor, or clear_resize_buffer in stack traces.
• Logs: AddressSanitizer reports (if enabled) showing heap-buffer-overflow at FreeRDPWriteColor_int in color.h; application logs showing errors from rdpgfx_recv_wire_to_surface_1_pdu or rdpgfx_decode.
• Network: Outbound RDP connections (TCP port 3389 or custom) to unfamiliar or suspicious server IPs, especially followed by immediate client process termination; unusual RDPGFX channel traffic with large nWidth/nHeight values in surface PDUs.
• File System: Core dump files generated by the FreeRDP client process in the working directory or system crash directory shortly after an RDP connection attempt (GitHub Advisory).

Upgrade FreeRDP to version 3.21.0 or later, which contains the fix for this vulnerability (FreeRDP Release). Red Hat has issued multiple errata addressing this issue across RHEL 7, 8, 9, and 10 (RHSA-2026:2048, RHSA-2026:2081, RHSA-2026:2222, and others); users of affected RHEL versions should apply the relevant errata (Red Hat Bugzilla). Ubuntu, SUSE, Fedora, Rocky Linux, AlmaLinux, and other distributions have also released updated packages. As a workaround for systems that cannot be immediately patched, restrict FreeRDP client connections to trusted, verified RDP servers only, and implement network segmentation to prevent connections to untrusted endpoints.

The vulnerability was reported by security researcher ehdgks0627, who was credited in the FreeRDP 3.21.0 release notes for discovering multiple client-side vulnerabilities (CVE-2026-23530 through CVE-2026-23534 and others) (FreeRDP Release). Red Hat classified the issue as high severity and promptly issued errata for all supported RHEL versions within weeks of disclosure (Red Hat Bugzilla). Coverage appeared across Linux security news outlets including LinuxSecurity.com and Pro-Linux.de, reflecting broad distribution-level attention to the patch.