CVE-2026-24675: 
NixOS vulnerability analysis and mitigation

CVE-2026-24675 is a heap use-after-free vulnerability in FreeRDP's USB redirection channel (urbdrc) affecting all versions prior to 3.22.0. In the urb_select_interface function, when msusb_msinterface_replace fails (e.g., due to an out-of-range interface number), the device's MS config (MsConfig) is freed via msusb_msconfig_free, but libusb_udev_select_interface subsequently dereferences the now-freed pointer. The vulnerability was published on February 9, 2026, and fixed in FreeRDP 3.22.0. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, Red Hat CVE).

The root cause is a use-after-free (CWE-416) combined with an expired pointer dereference (CWE-825) in channels/urbdrc/client/data_transfer.c. When msusb_msinterface_replace returns failure inside urb_select_interface, the code calls msusb_msconfig_free(MsConfig) and returns an error — but the device's pdev->MsConfig pointer is not nulled out. A subsequent call to libusb_udev_select_interface in libusb_udevice.c then reads pdev->MsConfig->MsInterfaces from the freed heap region, triggering the use-after-free. The fix (commit d676518) removes the premature msusb_msconfig_free call, deferring cleanup to the channel's normal teardown path. The vulnerability is reachable via the RDP dynamic virtual channel (DRDYNVC) processing path, triggered by a crafted USB interface selection message from a malicious server (GitHub Advisory, GitHub Commit).

A malicious RDP server can trigger a client-side heap use-after-free, causing the FreeRDP client to crash (denial of service). Depending on heap layout and allocator behavior, the vulnerability also carries a theoretical risk of heap corruption that could lead to arbitrary code execution on the connecting client. Confidentiality and integrity are not directly impacted under the standard CVSS assessment, but the heap corruption potential means code execution cannot be fully ruled out in adversarial conditions (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of writing. The CVSS v4.0 exploit maturity is rated "Proof of Concept" in the Feedly data, though this likely reflects the AddressSanitizer crash reproduction included in the GitHub advisory rather than a weaponized exploit. The EPSS score is approximately 0.042%, indicating low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires the victim to connect to a malicious RDP server with USB redirection enabled, which limits opportunistic exploitation (GitHub Advisory, Red Hat CVE).

1. Set up a malicious RDP server: Deploy a rogue RDP server (e.g., a modified FreeRDP server or custom implementation) that supports the USB redirection dynamic virtual channel (DRDYNVC/URBDRC).
2. Lure the victim to connect: Social-engineer or redirect a target running a vulnerable FreeRDP client (version < 3.22.0) with USB redirection enabled (/usb or equivalent flag) to connect to the malicious server.
3. Initiate USB device enumeration: Allow the RDP session to establish and the URBDRC channel to initialize, causing the client to register USB devices and allocate MsConfig structures.
4. Send a crafted URB_SELECT_INTERFACE request: Transmit a malformed TS_URB_SELECT_INTERFACE message over the dynamic virtual channel containing an out-of-range InterfaceNumber, causing msusb_msinterface_replace to fail and triggering the premature msusb_msconfig_free call.
5. Trigger the use-after-free: The freed MsConfig pointer is subsequently dereferenced in libusb_udev_select_interface, causing a heap use-after-free — resulting in a crash (DoS) or, under favorable heap conditions, potential code execution on the client (GitHub Advisory).

• Process: FreeRDP client process (xfreerdp, wfreerdp) crashing unexpectedly during an active RDP session, particularly when USB redirection is enabled.
• Logs: AddressSanitizer output (if enabled) reporting heap-use-after-free in libusb_udev_select_interface at libusb_udevice.c:554; application crash logs referencing urb_select_interface or urbdrc_process_transfer_request.
• Network: Unexpected or repeated RDP connections to unfamiliar server IP addresses; RDP traffic containing anomalous DRDYNVC channel data with malformed USB interface descriptors.
• File System: Core dump files generated by the FreeRDP client process in the working directory or /var/crash/ following an unexpected termination (GitHub Advisory).

Upgrade FreeRDP to version 3.22.0 or later, which removes the premature msusb_msconfig_free call in urb_select_interface (commit d676518). Red Hat has issued patches across RHEL 7 through 10 via multiple errata (RHSA-2026:6340, RHSA-2026:6727, RHSA-2026:6743, RHSA-2026:6799, RHSA-2026:6918, and others). Ubuntu addressed this in USN-8042-1, and openSUSE, Mageia, Amazon Linux 2, and AlmaLinux have also released updated packages. As a workaround where patching is not immediately possible, disable USB redirection in FreeRDP client configurations to prevent the vulnerable code path from being reached (GitHub Commit, Red Hat Bugzilla, Ubuntu Advisory).

The vulnerability was reported by security researcher ehdgks0627 and published by the FreeRDP maintainer akallabeth via GitHub Security Advisories on February 9, 2026. The FreeRDP project announced the 3.22.0 release on January 28, 2026, which included this and other security fixes. Multiple Linux distributions (Red Hat, Ubuntu, openSUSE, Mageia, AlmaLinux, Amazon Linux) responded promptly with updated packages within weeks of disclosure. Coverage was noted on oss-security mailing lists and Linux security news aggregators (GitHub Advisory, FreeRDP Release, oss-sec).