CVE-2026-24678: 
NixOS vulnerability analysis and mitigation

CVE-2026-24678 is a heap use-after-free vulnerability in FreeRDP's camera device channel (rdpecam) that can be triggered by a malicious RDP server to cause a denial-of-service crash and potential heap corruption on the client side. It affects all FreeRDP versions up to and including 3.21.0, and was fixed in version 3.22.0. The vulnerability was published on February 9, 2026, with the GitHub security advisory (GHSA-6gvg-29wx-6v7h) credited to researcher ehdgks0627. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (Red Hat Advisory, GitHub Advisory).

The root cause is a race condition (CWE-416: Use After Free; CWE-825: Expired Pointer Dereference) in the rdpecam channel's device close path. When a device channel close is processed by ecam_dev_on_close, it frees the channel callback (hchannel) without first stopping active capture streams. A concurrently running capture thread (cam_v4l_stream_capture_thread) may still hold a reference to the freed callback in stream->hSampleReqChannel and subsequently call ecam_dev_send_sample_response, which invokes ecam_channel_write and dereferences the freed pointer. The fix (commit f3ab1a1) adds explicit stream-stop calls for all streams before the channel callback is freed, ensuring no capture thread can access the freed memory (GitHub Advisory, GitHub Commit).

A malicious RDP server can exploit this vulnerability to trigger a client-side heap use-after-free, causing the FreeRDP client process to crash (denial of service). Depending on heap layout and allocator behavior, the heap corruption could theoretically be leveraged for arbitrary code execution on the connecting client, though the primary confirmed impact is availability loss. There is no confidentiality or integrity impact confirmed at this time (GitHub Advisory, Red Hat Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.042%, indicating a low probability of exploitation in the near term. The attack requires no authentication and no user interaction, but does require the victim to connect to a malicious RDP server, which limits opportunistic exploitation (Red Hat Advisory, GitHub Advisory).

1. Set up a malicious RDP server: An attacker configures a rogue RDP server that supports the rdpecam (Remote Desktop Protocol camera redirection) dynamic virtual channel.
2. Lure victim to connect: The attacker tricks a user running a vulnerable FreeRDP client (version ≤ 3.21.0) into connecting to the malicious server, for example via a phishing link or a man-in-the-middle attack.
3. Initiate camera redirection: The malicious server negotiates and opens the rdpecam dynamic virtual channel with the client, causing the client to start a camera capture stream and spawn a capture thread (cam_v4l_stream_capture_thread).
4. Trigger channel close race: The server sends a dynamic virtual channel close request (drdynvc_process_close_request) for the rdpecam channel while the capture thread is actively sending sample responses.
5. Exploit the race condition: The close handler (ecam_dev_on_close) frees the channel callback without stopping the capture thread. The still-running capture thread dereferences the freed hSampleReqChannel pointer in ecam_channel_write, triggering a heap use-after-free.
6. Achieve DoS or potential code execution: The freed memory dereference causes the FreeRDP client to crash (DoS). Depending on heap layout, an attacker may attempt to control the freed region to achieve code execution (GitHub Advisory, GitHub Commit).

• Process: FreeRDP client process (xfreerdp or similar) crashes unexpectedly, particularly when camera redirection is active during an RDP session.
• Logs: AddressSanitizer output (if enabled) showing heap-use-after-free in ecam_channel_write at camera_device_enum_main.c:89; crash dumps referencing ecam_dev_send_sample_response or cam_v4l_stream_capture_thread in the stack trace.
• Network: Unexpected or repeated RDP dynamic virtual channel close requests (drdynvc close) from the server shortly after camera stream initiation; connections to unfamiliar or suspicious RDP server IP addresses.
• File System: Core dump files generated by the FreeRDP client process in the working directory or system crash directory following an RDP session with camera redirection (GitHub Advisory).

Upgrade FreeRDP to version 3.22.0 or later, which contains the fix introduced in commit f3ab1a1 that ensures all capture streams are stopped before the channel callback is freed. Red Hat Enterprise Linux users can apply the errata RHSA-2026:3068 (RHEL 10), RHSA-2026:4121 (RHEL 10.0 EUS), or RHSA-2026:19033 (RHEL 10). Ubuntu users should apply USN-8042-1. As a workaround where upgrading is not immediately possible, disabling camera redirection in FreeRDP client configurations (e.g., avoiding the /drive or camera redirection flags) can prevent the vulnerable code path from being triggered (Red Hat Bugzilla, GitHub Commit, Ubuntu Advisory).

Red Hat triaged the vulnerability as high severity and issued multiple errata (RHSA-2026:3068, RHSA-2026:4121, RHSA-2026:19033) addressing affected RHEL 10 packages. Ubuntu, openSUSE, Mageia, Fedora, Rocky Linux, AlmaLinux, and Oracle Linux all issued security advisories and updated packages. The FreeRDP project published a release announcement for version 3.22.0 noting the security fixes. The vulnerability was also discussed on the oss-security mailing list. No notable social media controversy or significant researcher commentary beyond the standard advisory cycle has been observed (Red Hat Bugzilla, FreeRDP Release, Ubuntu Advisory).