CVE-2026-24491: 
NixOS vulnerability analysis and mitigation

CVE-2026-24491 is a heap use-after-free vulnerability in FreeRDP's video_timer component, classified as Heap-use-after-free in video_timer. The flaw affects all FreeRDP versions prior to 3.22.0 (i.e., ≤ 3.21.0) and was disclosed on February 9, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 7.7 (High) (Red Hat CVE, GitHub Advisory).

The root cause is a race condition between the video_timer callback and the dynamic virtual channel (drdynvc) close path, classified as CWE-416 (Use After Free) and CWE-825 (Expired Pointer Dereference). When the RDP control channel is closed, video_control_on_close frees the channel callback object (pChannelCallback), but the video_timer thread can still fire and call video_control_send_client_notification, which dereferences video->control_callback->channel_callback->channel — a pointer into the already-freed memory region. The fix (commit e02e052) resets channel->channel_callback to NULL before invoking OnClose, ensuring any subsequent timer-triggered dereference encounters a null pointer rather than freed heap memory (GitHub Commit, GitHub Advisory).

Successful exploitation causes the FreeRDP client process to crash (denial of service) due to heap corruption triggered by the freed-memory dereference. Depending on heap layout and allocator behavior, the use-after-free condition also carries a theoretical risk of heap corruption that could lead to arbitrary code execution on the client system. The vulnerability has no impact on confidentiality or integrity in the typical DoS scenario, but the availability of RDP sessions is fully disrupted (GitHub Advisory, Red Hat CVE).

The vulnerability is exploitable remotely by a malicious RDP server with no authentication and no user interaction required, making it trivially triggerable against clients connecting to attacker-controlled servers. The CVSS v4.0 exploit maturity is rated Proof of Concept (E:P), though no public PoC exploit code has been confirmed as of the time of writing. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the CVE is not listed in the CISA KEV catalog. The EPSS score is approximately 0.042%, indicating low current exploitation probability (GitHub Advisory, Red Hat CVE).

1. Set up a malicious RDP server: The attacker configures a rogue RDP server (e.g., using a modified FreeRDP server build or a custom RDP implementation) that supports the Dynamic Virtual Channel (drdynvc) and the Video Redirection virtual channel.
2. Lure the victim client: Trick a user running a vulnerable FreeRDP client (version ≤ 3.21.0) into connecting to the attacker's server, for example via a phishing link or a man-in-the-middle attack on an existing RDP session.
3. Establish the video control channel: During the RDP session, the server negotiates and opens the video dynamic virtual channel, causing the client to allocate a channel_callback object and register the video_timer.
4. Trigger the race condition: The server sends a channel close request (DYNVC_CLOSE) for the video control channel, causing video_control_on_close to free the channel_callback object on the client side.
5. Exploit the use-after-free: Before the timer thread is stopped, the video_timer fires and calls video_control_send_client_notification, which dereferences the now-freed channel_callback pointer, triggering a heap-use-after-free crash (DoS) or, under favorable heap conditions, potential code execution on the client (GitHub Advisory, GitHub Commit).

• Process: Unexpected crash or abort of the FreeRDP client process (xfreerdp, wfreerdp, or similar) with an AddressSanitizer report referencing video_control_send_client_notification in video_main.c or a segmentation fault in the video_timer thread.
• Logs: Core dump files or crash reports from the FreeRDP client process; system logs (e.g., /var/log/syslog, journald) showing abnormal termination of the FreeRDP process shortly after connecting to an RDP server.
• Network: Outbound RDP connections (TCP port 3389 or custom RDP ports) to unfamiliar or untrusted server IP addresses, particularly if followed immediately by client process termination.
• File System: Presence of core dump files (e.g., core, core.<pid>) in the working directory of the FreeRDP client process following a crash (GitHub Advisory).

The primary remediation is to upgrade FreeRDP to version 3.22.0 or later, which contains the fix introduced in commit e02e052 (GitHub Commit). Red Hat has issued multiple errata addressing this CVE across RHEL 7 through RHEL 10 (RHSA-2026:6340, RHSA-2026:6727, RHSA-2026:6743, RHSA-2026:6799, RHSA-2026:6918, and others); Ubuntu addressed it in USN-8042-1; openSUSE, Mageia, Amazon Linux 2, and AlmaLinux have also released patches (Red Hat Bugzilla, Ubuntu Advisory). As a temporary workaround where patching is not immediately possible, restrict FreeRDP client connections to trusted RDP servers only and block outbound RDP to untrusted or unknown hosts at the network perimeter.

The vulnerability was reported by security researcher ehdgks0627 and published by the FreeRDP maintainer (akallabeth) via GitHub Security Advisories on February 9, 2026 (GitHub Advisory). The FreeRDP project released version 3.22.0 on January 28, 2026, ahead of the CVE publication, and announced the release on their official blog (FreeRDP Blog). The vulnerability received routine coverage from Linux security news aggregators and distribution security teams (Red Hat, Ubuntu, openSUSE, Mageia, AlmaLinux), with no notable controversy or exceptional community reaction beyond standard patch advisories.