CVE-2026-23884: 
NixOS vulnerability analysis and mitigation

CVE-2026-23884 is a heap use-after-free (UAF) vulnerability in FreeRDP's offscreen bitmap cache, specifically in the gdi_set_bounds function. When an RDP CREATE_OFFSCREEN_BITMAP order deletes a bitmap via its deleteList, the gdi->drawing pointer is left pointing to freed memory; subsequent primary orders with ORDER_BOUNDS then dereference this dangling pointer, triggering the UAF. All FreeRDP versions up to and including 3.20.2 are affected; version 3.21.0 contains the fix. The vulnerability was disclosed on January 19, 2026, and carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a CWE-416 (Use After Free) condition in libfreerdp/cache/offscreen.c. The update_gdi_create_offscreen_bitmap function processes the deleteList field of a CREATE_OFFSCREEN_BITMAP order by calling offscreen_cache_delete, which frees the rdpBitmap object without checking whether gdi->drawing still references it. If a prior SWITCH_SURFACE order had set gdi->drawing to that bitmap via update_gdi_switch_surface → bitmap->SetSurface, the pointer becomes dangling. When the server subsequently sends a primary drawing order containing ORDER_BOUNDS, update->SetBounds calls gdi_set_bounds at libfreerdp/gdi/gdi.c:569, which dereferences gdi->drawing->hdc on the freed memory. The attack requires only network access to a FreeRDP client connected to a malicious server — no authentication or user interaction is needed (GitHub Advisory, FreeRDP Source).

A malicious RDP server can trigger this vulnerability on any connecting FreeRDP client without requiring authentication or user interaction. The immediate impact is a denial of service via application crash; however, depending on heap allocator behavior and surrounding heap layout, the UAF can lead to heap corruption with potential for arbitrary code execution on the client system. Confidentiality, integrity, and availability are all rated HIGH under CVSS v3.1, reflecting the risk of full client-side compromise (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept exploit is publicly available via the FreeRDP GitHub security advisory, and the CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT (GitHub Advisory). As of the time of disclosure, there is no evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.083%, indicating a currently low probability of widespread exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is fully network-exploitable with no privileges or user interaction required, making it attractive for future weaponization (Feedly).

1. Set up a malicious RDP server: Configure a rogue RDP server (e.g., using a modified FreeRDP server build or a custom RDP implementation) capable of sending crafted protocol messages.
2. Lure or intercept a FreeRDP client connection: Direct a victim running FreeRDP ≤ 3.20.2 to connect to the malicious server, for example via a phishing link, DNS poisoning, or man-in-the-middle attack on an RDP session.
3. Send a SWITCH_SURFACE order: Transmit an RDP SWITCH_SURFACE alternate secondary order referencing a specific offscreen bitmap ID, causing the client's gdi->drawing pointer to be set to that bitmap's memory address.
4. Send a CREATE_OFFSCREEN_BITMAP order with a deleteList: Transmit a CREATE_OFFSCREEN_BITMAP order whose deleteList includes the bitmap ID used in step 3, triggering offscreen_cache_delete and freeing the bitmap memory while gdi->drawing still points to it.
5. Send a primary order with ORDER_BOUNDS: Transmit a primary drawing order that includes ORDER_BOUNDS, causing gdi_set_bounds to dereference the now-freed gdi->drawing->hdc pointer, triggering the heap-use-after-free.
6. Achieve DoS or code execution: At minimum, the client process crashes (DoS). With heap grooming techniques to control allocator behavior and reclaim the freed memory with attacker-controlled data, arbitrary code execution on the client may be achievable (GitHub Advisory).

• Process: FreeRDP client process (xfreerdp, wlfreerdp, or embedded FreeRDP) crashes unexpectedly, particularly during or shortly after establishing an RDP session to an external or untrusted server.
• Logs: AddressSanitizer output (if enabled) showing heap-use-after-free at gdi_set_bounds in libfreerdp/gdi/gdi.c:569; crash dumps referencing update_recv_primary_order, fastpath_recv_orders, or offscreen_cache_delete in the stack trace.
• Network: Unusual RDP traffic patterns from a server sending CREATE_OFFSCREEN_BITMAP orders with non-empty deleteList fields immediately following SWITCH_SURFACE orders targeting the same bitmap ID; connections to unexpected or newly registered RDP server IP addresses.
• File System: Core dump files (core.*) generated by the FreeRDP client process in the working directory or /var/crash/, potentially containing heap memory artifacts (GitHub Advisory).

Upgrade FreeRDP to version 3.21.0 or later, which contains the patch for this vulnerability (FreeRDP Release). Red Hat has issued multiple errata addressing this issue across RHEL 7–10 (RHSA-2026:2048, RHSA-2026:2081, RHSA-2026:2222, RHSA-2026:2714, and others) (Red Hat Bugzilla). As an interim workaround until patching is complete, restrict FreeRDP client connections to only trusted, known-good RDP servers and avoid connecting to untrusted or externally hosted RDP endpoints. Fedora, SUSE, Ubuntu, AlmaLinux, Rocky Linux, Oracle Linux, Amazon Linux 2, Debian, and Mageia have also released updated packages.

The vulnerability was credited to researcher ehdgks0627, who reported multiple client-side vulnerabilities addressed in the FreeRDP 3.21.0 release (FreeRDP Release). Red Hat classified the issue as high severity and tracked it through Bugzilla, issuing over a dozen errata across supported RHEL versions (Red Hat Bugzilla). Coverage appeared on Linux security news aggregators including linuxsecurity.com and pro-linux.de, and the vulnerability was picked up by Nessus and Qualys scanner plugins shortly after disclosure. No significant social media controversy or broad public debate has been observed.