CVE-2026-24676: 
NixOS vulnerability analysis and mitigation

CVE-2026-24676 is a heap use-after-free vulnerability in FreeRDP's AUDIN (Audio Input) channel affecting all versions prior to 3.22.0. During AUDIN format renegotiation, the audin_process_formats function frees the active audio format list (callback->formats) while the capture thread continues to reference audin->format — a pointer into that freed memory — leading to a use-after-free condition in audio_format_compatible. The vulnerability was published on February 9, 2026, and fixed in FreeRDP 3.22.0 released January 28, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-416 (Use After Free) and CWE-825 (Expired Pointer Dereference). When a MSG_SNDIN_FORMATS PDU is received, audin_process_formats calls audio_formats_free(callback->formats, ...) to release the existing format list and allocates a new one, but does not reset audin->format — which is a pointer into the now-freed callback->formats array (set at audin->format = &callback->formats[NewFormat]). Concurrently, the PulseAudio capture thread calls audin_receive_wave_data, which invokes audio_format_compatible and dereferences fields (e.g., wFormatTag, nChannels) from the stale, freed pointer. The fix (commit 026b81a) adds audin->format = NULL at two points in audin_process_formats — before freeing the format list and in the error path — preventing the dangling pointer from being dereferenced (GitHub Commit, GitHub Advisory).

Successful exploitation causes a heap use-after-free crash in the FreeRDP client process, resulting in a denial of service (DoS) by terminating the RDP session. The vulnerability is exploitable by a malicious or compromised RDP server sending a crafted MSG_SNDIN_FORMATS PDU during an active session with audio input (AUDIN) enabled. While the primary confirmed impact is availability loss (crash), heap corruption from the use-after-free could theoretically enable code execution depending on allocator behavior and heap layout, though no such exploitation has been demonstrated (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit or in-the-wild exploitation has been reported as of the time of writing. The CVSS v4.0 exploit maturity is rated "Proof of Concept" based on the AddressSanitizer trace included in the GitHub security advisory, which demonstrates the crash condition. The EPSS score is approximately 0.042%, indicating low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to control or impersonate an RDP server and the client must have the AUDIN channel active (GitHub Advisory, Red Hat CVE).

1. Set up a malicious RDP server: Deploy a custom or modified RDP server capable of sending crafted Dynamic Virtual Channel (DVC) messages, specifically targeting the AUDIN channel (MSG_SNDIN_FORMATS PDU).
2. Lure or redirect the target client: Convince a FreeRDP client (version < 3.22.0) to connect to the attacker-controlled server, or perform a man-in-the-middle attack on an existing RDP session.
3. Establish AUDIN channel: Ensure the client connects with audio input (microphone redirection) enabled, which activates the AUDIN dynamic virtual channel and starts the capture thread.
4. Trigger format renegotiation: Send an initial MSG_SNDIN_FORMATS PDU to establish a valid audio format, causing audin->format to point into callback->formats.
5. Send a second MSG_SNDIN_FORMATS PDU: Immediately send another MSG_SNDIN_FORMATS PDU while the capture thread is actively using audin->format. This causes audin_process_formats to free callback->formats while the capture thread dereferences the now-freed pointer in audio_format_compatible.
6. Trigger crash/heap corruption: The race condition between the channel processing thread and the PulseAudio capture thread results in a heap use-after-free, crashing the FreeRDP client process (GitHub Advisory, GitHub Commit).

• Process: FreeRDP client process (xfreerdp, wlfreerdp) crashing unexpectedly during an RDP session with audio input enabled; AddressSanitizer output referencing audio_format_compatible in libfreerdp/codec/audio.c if built with ASAN.
• Logs: Application crash logs or core dumps from the FreeRDP client process; segmentation fault or abort signals from the threaded-ml (PulseAudio) thread; FreeRDP debug logs showing repeated MSG_SNDIN_FORMATS PDU processing in rapid succession.
• Network: Unusual or repeated AUDIN channel format negotiation messages (MSG_SNDIN_FORMATS) from the RDP server in a short time window; RDP traffic to an unexpected or untrusted server IP address.
• File System: Core dump files (e.g., core.*) generated in the FreeRDP working directory following a crash during an RDP session with microphone redirection active.

Upgrade FreeRDP to version 3.22.0 or later, which contains the fix (commit 026b81a) that resets audin->format to NULL before freeing the format list (GitHub Commit). Red Hat has issued patches across multiple RHEL versions (7 ELS through 10) via advisories RHSA-2026:6340, RHSA-2026:6727, RHSA-2026:6743, RHSA-2026:6799, RHSA-2026:6918, RHSA-2026:6958, and others (Red Hat Bugzilla). Ubuntu addressed this in USN-8042-1, and openSUSE, Mageia, Amazon Linux 2, and Debian have also released updated packages. As a workaround, disable audio input (microphone) redirection in FreeRDP sessions (/microphone:off) to prevent the AUDIN channel from being activated, or restrict client connections to trusted RDP servers only.

The FreeRDP project published a release announcement for version 3.22.0 on January 28, 2026, addressing this and other vulnerabilities (FreeRDP Release). Red Hat rated the severity as "Moderate" and issued patches across a broad range of RHEL versions, reflecting the wide deployment of FreeRDP in enterprise Linux environments (Red Hat Bugzilla). The vulnerability was reported by security researcher ehdgks0627 and disclosed via the GitHub Security Advisory program. Coverage was primarily limited to Linux distribution security mailing lists and vulnerability tracking services, with no significant broader media attention.