CVE-2026-23883: 
NixOS vulnerability analysis and mitigation

CVE-2026-23883 is a heap use-after-free vulnerability in FreeRDP's X11 pointer handling code, specifically in the update_pointer_new / xf_Pointer_New function. When freerdp_image_copy_from_pointer_data fails, xf_Pointer_New frees cursorPixels, but the error-handling path in the caller then invokes pointer_free → xf_Pointer_Free, which attempts to free the same memory again, triggering a use-after-free. All FreeRDP versions prior to 3.21.0 are affected. The vulnerability was disclosed on January 19, 2026, with a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Red Hat CVE).

The root cause is a CWE-416 (Use After Free) defect in client/X11/xf_graphics.c. In xf_Pointer_New, when freerdp_image_copy_from_pointer_data returns failure, the function explicitly calls winpr_aligned_free(xpointer->cursorPixels) before jumping to the fail label. The caller (update_pointer_color in libfreerdp/cache/pointer.c, lines 164–174) then calls pointer_free(context, pointer) on the error path, which in turn calls xf_Pointer_Free, which unconditionally calls winpr_aligned_free(xpointer->cursorPixels) again on the already-freed pointer. A malicious RDP server can trigger this condition by sending a crafted POINTER_COLOR_UPDATE or POINTER_NEW_UPDATE fast-path PDU with invalid or malformed XOR/AND mask data that causes freerdp_image_copy_from_pointer_data to fail, initiating the double-free sequence without any user interaction (GitHub Advisory, FreeRDP Source).

A malicious RDP server can exploit this vulnerability to cause a client-side crash (denial of service) by triggering the use-after-free in winpr_aligned_free. Beyond DoS, the heap corruption resulting from the double-free creates potential for arbitrary code execution on the connecting client, depending on allocator behavior and surrounding heap layout at the time of exploitation. The attack requires no user interaction and no privileges on the attacker's side, as it is triggered entirely through server-to-client RDP protocol messages (GitHub Advisory, Red Hat CVE).

A proof-of-concept demonstrating the use-after-free is referenced in the FreeRDP GitHub security advisory, and the CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT. There is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.111%, indicating low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Set up a malicious RDP server: Deploy a rogue RDP server (e.g., using a modified FreeRDP server build or a custom RDP implementation) that can send crafted fast-path update PDUs to connecting clients.
2. Lure or intercept a client connection: Either advertise the malicious server to a target user running a vulnerable FreeRDP X11 client (version ≤ 3.20.2), or perform a man-in-the-middle attack on an existing RDP session.
3. Send a crafted pointer update PDU: Once the client connects, transmit a POINTER_COLOR_UPDATE or POINTER_NEW_UPDATE fast-path PDU containing malformed XOR mask data (e.g., invalid xorBpp, mismatched mask lengths, or corrupt pixel data) that will cause freerdp_image_copy_from_pointer_data to return failure inside xf_Pointer_New.
4. Trigger the use-after-free: The failure causes xf_Pointer_New to free cursorPixels, then the error path in update_pointer_color/update_pointer_new calls pointer_free → xf_Pointer_Free, which frees cursorPixels a second time, triggering heap corruption.
5. Achieve DoS or code execution: At minimum, the client process crashes (DoS). With heap grooming techniques to control allocator state, an attacker may be able to redirect execution to attacker-controlled data for arbitrary code execution on the client system (GitHub Advisory).

• Process: Unexpected crash or abort of the xfreerdp process, particularly with an AddressSanitizer report referencing winpr_aligned_free in alignment.c:252, xf_Pointer_Free in xf_graphics.c:340, or update_pointer_color in pointer.c:173.
• Logs: Application crash logs or core dumps from the FreeRDP client process (xfreerdp) with stack traces involving fastpath_recv_update, fastpath_recv_update_data, rdp_recv_fastpath_pdu, and xf_client_thread.
• Network: Unusual or repeated RDP fast-path update PDUs (opcode for pointer updates) from an unexpected or untrusted server IP, especially with malformed or oversized mask data fields.
• File System: Core dump files generated by the FreeRDP client process in the working directory or /var/crash/, potentially containing heap memory artifacts from the time of the crash.

Upgrade FreeRDP to version 3.21.0 or later, which contains the fix for this double-free condition (FreeRDP Release). Downstream Linux distributions including Red Hat Enterprise Linux (RHSA-2026:2081, RHSA-2026:2048, RHSA-2026:2222, RHSA-2026:2736, RHSA-2026:2770, RHSA-2026:2824, RHSA-2026:2952, RHSA-2026:3037), Rocky Linux, AlmaLinux, Fedora, SUSE, openSUSE, Ubuntu, Amazon Linux 2, Mageia, and Debian have released updated packages (Red Hat CVE). As a workaround where patching is not immediately feasible, restrict FreeRDP client connections to only trusted, known-good RDP servers, and consider disabling RDP client functionality until an upgrade can be applied.

The vulnerability was reported by security researcher ehdgks0627, who was credited in the FreeRDP 3.21.0 release notes alongside fixes for several other client-side vulnerabilities discovered in the same research effort (FreeRDP Release). The advisory was rated "Moderate" severity by the FreeRDP project itself despite the high CVSS v3.1 score, reflecting the practical difficulty of achieving code execution beyond a crash. Multiple Linux distribution security teams issued advisories and updated packages promptly following the disclosure (Red Hat CVE).