CVE-2026-23534: 
NixOS vulnerability analysis and mitigation

CVE-2026-23534 is a heap-based buffer overflow vulnerability in FreeRDP's ClearCodec bands decode path (clear_decompress_bands_data) that allows a malicious RDP server to trigger a client-side crash or potential arbitrary code execution. It affects all FreeRDP versions prior to 3.21.0. The vulnerability was disclosed on January 19, 2026, and patched in the same-day release of FreeRDP 3.21.0. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an off-by-one bounds check error (CWE-122: Heap-based Buffer Overflow) in libfreerdp/codec/clear.c. The clear_decompress_bands_data function computes destination pixel offsets (nXDstRel, nYDstRel) from stream-supplied xStart/xEnd/yStart/yEnd coordinates and validates them using strict greater-than comparisons (> nDstWidth and > nDstHeight). Because the check uses > instead of >=, coordinates equal to the surface dimensions pass validation, causing FreeRDPWriteColor_int to write one pixel past the end of the heap-allocated destination surface buffer. The exploit path is: rdpgfx_decode → gdi_SurfaceCommand_ClearCodec → clear_decompress_bands_data → FreeRDPWriteColor_int, triggered via a crafted WIRE_TO_SURFACE_PDU_1 message over the RDP Graphics Pipeline channel (GitHub Advisory, Source Code).

A malicious RDP server can reliably crash a connecting FreeRDP client (denial of service) by sending a crafted ClearCodec band payload. Beyond DoS, the out-of-bounds heap write introduces heap corruption that, depending on allocator behavior and surrounding heap layout, could enable arbitrary code execution on the client system. The vulnerability is entirely client-side — only users connecting to a malicious or compromised RDP server are at risk — but no user interaction beyond initiating an RDP session is required (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept exploit (AddressSanitizer crash reproducer) is publicly available in the GitHub security advisory, demonstrating reliable heap-buffer-overflow triggering. The CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT. The EPSS score is approximately 0.093%, indicating low but non-zero probability of near-term exploitation. No in-the-wild exploitation has been reported, and the vulnerability is not currently listed in the CISA KEV catalog. No specific threat actor attribution is known (GitHub Advisory, Feedly).

1. Set up a malicious RDP server: Deploy a custom or modified RDP server (e.g., using FreeRDP server components or a custom implementation) capable of sending crafted Graphics Pipeline Extension (RDPGFX) messages.
2. Lure the victim client: Convince a user running FreeRDP < 3.21.0 to connect to the attacker-controlled server (e.g., via phishing, DNS poisoning, or man-in-the-middle on an untrusted network).
3. Establish RDP session: Complete the standard RDP handshake and negotiate the Graphics Pipeline channel (rdpgfx) with the client.
4. Send crafted WIRE_TO_SURFACE_PDU_1: Transmit a WIRE_TO_SURFACE_PDU_1 message using ClearCodec encoding with a bands section containing xStart/xEnd/yStart/yEnd coordinates crafted so that nXDstRel + i == nDstWidth or nYDstRel + y == nDstHeight — values that pass the flawed > bounds check but cause an out-of-bounds write.
5. Trigger heap overflow: The client's clear_decompress_bands_data function computes an out-of-bounds destination pointer and FreeRDPWriteColor_int writes pixel data past the end of the allocated surface buffer.
6. Achieve DoS or code execution: At minimum, the client process crashes (DoS). With heap layout manipulation (e.g., heap grooming via prior RDP messages to control adjacent allocations), an attacker may achieve controlled heap corruption enabling code execution (GitHub Advisory).

• Process: Unexpected crash or abort of the xfreerdp, wlfreerdp, or other FreeRDP client process immediately after connecting to an RDP server; crash dumps referencing clear_decompress_bands_data, FreeRDPWriteColor_int, or libfreerdp/codec/clear.c.
• Logs: AddressSanitizer output (if compiled with ASan) showing heap-buffer-overflow at FreeRDPWriteColor_int in color.h:42; application crash logs or core dumps from FreeRDP client processes.
• Network: RDP sessions to unfamiliar or unexpected server IP addresses; WIRE_TO_SURFACE_PDU_1 messages with anomalous ClearCodec band coordinate values (detectable via RDP protocol inspection tools such as Wireshark with RDP dissectors).
• File System: Unexpected core dump files (e.g., core.*) in the working directory of the FreeRDP client process following an RDP session.

The primary remediation is to upgrade FreeRDP to version 3.21.0 or later, which tightens the destination bounds checks in clear_decompress_bands_data to use exclusive upper bounds (>=) (FreeRDP Release). Red Hat has issued patches for RHEL 8 (RHSA-2026:2081), RHEL 9 (RHSA-2026:2048), RHEL 10 (RHSA-2026:2222), and extended support variants (Red Hat Bugzilla). Fedora, SUSE, Ubuntu, openSUSE, Rocky Linux, AlmaLinux, Amazon Linux 2, and Mageia have also released updated packages. As a workaround where patching is not immediately possible, restrict FreeRDP client connections to trusted, verified RDP servers only, and avoid connecting to unknown or untrusted RDP endpoints.

The vulnerability was reported by security researcher ehdgks0627, who was credited in the FreeRDP 3.21.0 release notes for discovering multiple client-side vulnerabilities fixed in that release (FreeRDP Release). Red Hat classified the issue as high severity and tracked it through multiple errata across RHEL versions. Coverage appeared on Linux security news aggregators (linuxsecurity.com, pro-linux.de, linuxcompatible.org) and vulnerability databases shortly after disclosure. No significant social media controversy or broader industry debate has been noted.