CVE-2026-24677: 
NixOS vulnerability analysis and mitigation

CVE-2026-24677 is a heap-based buffer overflow vulnerability in FreeRDP's ecam_encoder_compress_h264 function, affecting all versions prior to 3.22.0. The flaw allows a malicious RDP server to supply crafted video dimensions that are trusted without source buffer size validation, triggering an out-of-bounds read (and potential heap corruption) in sws_scale during H.264 camera encoding. It was published on February 9, 2026, with a fix released in FreeRDP 3.22.0. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) (Red Hat Advisory, GitHub Advisory).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow) and CWE-125 (Out-of-bounds Read). The vulnerable code path begins in ecam_dev_process_start_streams_request, which reads a server-supplied MEDIA_TYPE_DESCRIPTION and stores it in stream->currMediaType without validating the width or height dimensions. Subsequently, ecam_encoder_compress_h264 uses these unvalidated dimensions to compute line sizes and calls sws_scale over srcData without checking whether srcSize is sufficient for the declared image dimensions, resulting in a heap buffer overflow. The fix (commit d2d4f44) introduces ecam_sws_valid() to verify that the sws context dimensions match currMediaType before use, and adds explicit bounds checks on width/height before creating or reusing the SwsContext (GitHub Advisory, GitHub Commit).

A malicious or compromised RDP server can exploit this vulnerability against connecting FreeRDP clients without any authentication or user interaction, triggering a client-side heap buffer overflow. The primary impact is denial of service via client crash; however, depending on heap layout and allocator behavior, heap corruption could potentially enable remote code execution on the client system. Confidentiality is also at risk through out-of-bounds memory reads that may expose heap contents to the server (GitHub Advisory, Red Hat Advisory).

No public proof-of-concept exploit or evidence of active in-the-wild exploitation has been observed as of the time of reporting (Red Hat Advisory). The vulnerability is network-exploitable with no privileges required and no user interaction needed, making it highly automatable if weaponized. The EPSS score is approximately 0.042% (0.000420), indicating a currently low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was reported by researcher ehdgks0627 (GitHub Advisory).

1. Set up a malicious RDP server: Deploy a rogue RDP server (e.g., a modified FreeRDP server or custom implementation) that supports the Remote Desktop Camera Redirection (rdpecam) virtual channel.
2. Lure or redirect a FreeRDP client: Convince a target user running a vulnerable FreeRDP client (version < 3.22.0) to connect to the malicious server, or perform a man-in-the-middle attack on an existing RDP session.
3. Send crafted MEDIA_TYPE_DESCRIPTION: During the camera stream negotiation, send a StartStreams request containing a MEDIA_TYPE_DESCRIPTION with inflated or mismatched Width and Height values that exceed the actual camera frame buffer size.
4. Trigger the overflow: When the FreeRDP client processes the camera frame, ecam_encoder_compress_h264 uses the server-supplied dimensions to call sws_scale, reading beyond the allocated source buffer and causing a heap buffer overflow.
5. Achieve DoS or potential code execution: The overflow crashes the FreeRDP client process (DoS). With careful heap grooming, an attacker may be able to achieve arbitrary code execution on the client system (GitHub Advisory, GitHub Commit).

• Process: Unexpected crash or abort of the FreeRDP client process (xfreerdp, wfreerdp, etc.), particularly during camera redirection sessions; AddressSanitizer reports referencing ecam_encoder_compress_h264 or sws_scale in stack traces.
• Logs: Application crash logs or core dumps from the FreeRDP client process; system logs showing abnormal termination of the FreeRDP process (e.g., SIGABRT, SIGSEGV) during RDP sessions with camera redirection enabled.
• Network: RDP connections to unfamiliar or unexpected server IP addresses; unusual StartStreams requests over the rdpecam dynamic virtual channel with anomalous media type dimension values.
• File System: Core dump files generated in the FreeRDP working directory following a crash during a camera-enabled RDP session (GitHub Advisory).

Upgrade FreeRDP to version 3.22.0 or later, which contains the fix introduced in commit d2d4f44 (GitHub Commit). Linux distribution users should apply vendor-provided security updates: Ubuntu users should apply USN-8042-1, openSUSE users should apply the relevant security announcement, and Amazon Linux 2 users should apply ALAS2-2026-3181. As a workaround where upgrading is not immediately possible, disable camera redirection in FreeRDP client configurations and restrict RDP connections to trusted servers only. Network segmentation to limit client exposure to untrusted RDP servers is also recommended (Red Hat Advisory, GitHub Advisory).

The vulnerability was disclosed via the FreeRDP GitHub Security Advisory (GHSA-xw37-j744-f8v7) on February 9, 2026, alongside the FreeRDP 3.22.0 release announcement. Red Hat tracked the issue as a medium-severity bug (Bugzilla #2438206) and issued a CVE advisory. Multiple Linux distributions including Ubuntu, openSUSE, Mageia, Fedora, and Amazon Linux 2 issued security advisories and package updates in the weeks following disclosure. Coverage was noted on security aggregation sites including LinuxSecurity.com and pro-linux.de (Red Hat Advisory, GitHub Advisory).