CVE-2026-23948: 
NixOS vulnerability analysis and mitigation

CVE-2026-23948 is a NULL Pointer Dereference vulnerability in FreeRDP's rdp_write_logon_info_v2() function that allows a malicious RDP server to crash the FreeRDP proxy via a specially crafted LogonInfoV2 PDU. It affects all FreeRDP versions up to and including 3.21.0, and was fixed in version 3.22.0. The vulnerability was published on February 9, 2026, with the security advisory authored by the FreeRDP maintainer akallabeth. It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, GitHub Advisory).

The root cause (CWE-476: NULL Pointer Dereference) lies in libfreerdp/core/info.c. The rdp_info_read_string() function sets the destination pointer to NULL and returns TRUE (success) when the size field is zero — meaning when a malicious server sends a LogonInfoV2 PDU with cbDomain=0 or cbUserName=0, parsing succeeds but info->domain or info->username is left as NULL. When the FreeRDP proxy subsequently calls rdp_write_logon_info_v2() to forward this PDU to a client, it invokes strnlen(NULL, 256) without a NULL check, causing a crash. Notably, the same class of bug had previously been fixed in rdp_write_logon_info_v1() (commit 71e463e), but the fix was not applied to the v2 variant. The fix (commit 4d44e3c) adds NULL guards for both info->domain and info->username before calling strnlen() (GitHub Advisory, GitHub Commit).

Successful exploitation results in a Denial of Service (DoS) condition — the FreeRDP proxy process crashes, disrupting service for all clients routed through that proxy instance. There is no confidentiality or integrity impact; only availability is affected. Organizations using FreeRDP proxy as a gateway or middlebox connecting to untrusted RDP servers are the primary at-risk population (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of writing. The vulnerability is network-exploitable with no authentication or user interaction required, making it straightforward to trigger if an attacker controls or impersonates an RDP server reachable by the proxy. The EPSS score is approximately 0.044% (low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Red Hat CVE).

1. Set up a malicious RDP server: Configure a rogue RDP server (e.g., using a modified FreeRDP server or a custom RDP implementation) capable of sending crafted SaveSessionInfo PDUs containing a LogonInfoV2 structure.
2. Craft the malicious PDU: Construct a LogonInfoV2 PDU with cbDomain=0 and/or cbUserName=0. This causes the FreeRDP proxy's parser (rdp_info_read_string()) to set info->domain or info->username to NULL while returning success.
3. Position the malicious server: Ensure the target FreeRDP proxy is configured to connect to (or can be redirected to) the attacker-controlled RDP server — for example, via DNS spoofing, ARP poisoning, or by operating a server that the proxy is legitimately configured to reach.
4. Trigger the crash: When the FreeRDP proxy receives the crafted SaveSessionInfo PDU and attempts to forward it to the client via rdp_write_logon_info_v2(), the missing NULL check causes strnlen(NULL, 256) to be called, crashing the proxy process and causing a DoS for all connected clients (GitHub Advisory, GitHub Commit).

• Logs: Sudden termination or crash log entries for the freerdp-proxy process; segmentation fault (SIGSEGV) or similar signals in system logs (e.g., /var/log/syslog, journalctl) referencing the FreeRDP proxy binary.
• Process: Unexpected restarts of the freerdp-proxy daemon; core dump files generated in the proxy's working directory following a crash.
• Network: Inbound RDP connections from unexpected or untrusted server IPs to the FreeRDP proxy; network traffic containing SaveSessionInfo PDUs with zero-length domain or username fields (detectable via deep packet inspection on RDP traffic, TCP port 3389).

The primary remediation is to upgrade FreeRDP to version 3.22.0 or later, which includes the fix in commit 4d44e3c. As a workaround prior to patching, implement network segmentation to restrict FreeRDP proxy connections to only trusted, known-good RDP servers, and disable the proxy if it is not actively required. Red Hat has issued multiple errata addressing this issue across RHEL 7 through 10 (RHSA-2026:6340, RHSA-2026:6727, RHSA-2026:6743, RHSA-2026:6799, RHSA-2026:6918, and others); Ubuntu issued USN-8042-1; and openSUSE, Mageia, Amazon Linux 2, and AlmaLinux have also released updated packages (GitHub Advisory, Red Hat Bugzilla, Ubuntu USN).

The vulnerability was reported by a researcher credited as "Keryer" and published by FreeRDP maintainer akallabeth via the GitHub Security Advisory program. Red Hat triaged it as medium severity and issued a broad set of errata across multiple RHEL versions. Coverage was picked up by Linux security news aggregators including LinuxSecurity.com, pro-linux.de, and linuxcompatible.org, reflecting standard community awareness for a moderate-severity open-source library CVE. No notable social media controversy or high-profile researcher commentary beyond the official advisory has been observed (GitHub Advisory, Red Hat Bugzilla).