CVE-2026-23732: 
NixOS vulnerability analysis and mitigation

CVE-2026-23732 is a heap-based buffer overflow vulnerability in FreeRDP's FastGlyph parsing logic, affecting all versions prior to 3.21.0. The flaw allows a malicious RDP server to trigger a client-side heap buffer overflow by sending crafted FastGlyph drawing orders, resulting in a denial-of-service (DoS) crash. It was disclosed on January 19, 2026, with a patch released in FreeRDP version 3.21.0. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 5.5 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is a missing size validation in the FastGlyph order parsing code (CWE-122: Heap-based Buffer Overflow). Specifically, update_read_fast_glyph_order in libfreerdp/core/orders.c sets glyph->cb = Stream_GetRemainingLength(sub) without validating that this value is consistent with the minimum buffer size implied by the glyph's cx (width) and cy (height) dimensions. The glyph data is then passed to Glyph_Alloc in libfreerdp/core/graphics.c, which allocates exactly cb bytes via malloc(glyph->cb) and copies data without cross-checking against the required scanline × height size. Subsequently, freerdp_glyph_convert in libfreerdp/codec/color.c reads scanline * height bytes from the allocated buffer, immediately triggering an out-of-bounds read when cb is smaller than required. A proof-of-concept AddressSanitizer trace confirms the heap-buffer-overflow occurs at freerdp_glyph_convert (GitHub Advisory).

Successful exploitation causes the FreeRDP client process to crash, resulting in a denial-of-service condition. The attack requires no user interaction and no authentication — any client connecting to a malicious RDP server is at risk. There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability, affecting the FreeRDP client on the connecting system (GitHub Advisory, Red Hat CVE).

A proof-of-concept exploit is publicly referenced in the GitHub security advisory, demonstrating the heap-buffer-overflow via AddressSanitizer output. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.072%, indicating low probability of near-term exploitation. No threat actor attribution has been reported (GitHub Advisory, Red Hat CVE).

1. Set up a malicious RDP server: Deploy a custom or modified RDP server capable of sending crafted protocol messages, such as a modified FreeRDP server or a purpose-built RDP server implementation.
2. Craft a malicious FastGlyph order: Construct a FAST_GLYPH_ORDER PDU where the cbData field (remaining stream length) is set to a value smaller than the minimum required by the cx (width) and cy (height) glyph dimensions — for example, setting cbData to a small value while specifying large cx/cy values.
3. Deliver the order to the client: Wait for or induce a FreeRDP client (version ≤ 3.20.2) to connect to the malicious server. The server sends the crafted FastGlyph drawing order during the RDP session.
4. Trigger the overflow: The client's update_read_fast_glyph_order accepts the undersized cbData, Glyph_Alloc allocates a buffer of that size, and freerdp_glyph_convert reads beyond the allocation boundary, causing a heap-buffer-overflow and crashing the client process (GitHub Advisory).

• Process: Unexpected crash or termination of the FreeRDP client process (xfreerdp, wfreerdp, or similar) immediately after connecting to an RDP server.
• Logs: AddressSanitizer or crash reports referencing freerdp_glyph_convert in libfreerdp/codec/color.c, Glyph_Alloc in libfreerdp/core/graphics.c, or update_gdi_fast_glyph in libfreerdp/cache/glyph.c.
• Network: RDP connections to unfamiliar or untrusted server IP addresses, particularly those that result in immediate client crashes.
• System: Core dump files generated by the FreeRDP client process in the working directory or system crash directory following an RDP session attempt.

Upgrade FreeRDP to version 3.21.0 or later, which contains the fix introduced in commits 3bc1eeb4f63 (new API function) and 9f0eb3b7d43 (applying the validation). As a workaround, restrict FreeRDP client connections to trusted, known-good RDP servers and avoid connecting to untrusted or unknown RDP endpoints. Downstream distributions including Fedora, SUSE, openSUSE, Ubuntu, Red Hat Enterprise Linux, AlmaLinux, Rocky Linux, Amazon Linux 2, Mageia, and Debian have released updated packages incorporating this fix (GitHub Advisory, Red Hat CVE).

The vulnerability was reported by security researcher ehdgks0627 and disclosed via the FreeRDP GitHub security advisory program. Red Hat tracked the issue via Bugzilla and assigned it a Medium severity rating. Multiple Linux distributions responded promptly with package updates. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability tracking and distribution advisory channels (GitHub Advisory, Red Hat CVE).