CVE-2026-24679: 
NixOS vulnerability analysis and mitigation

CVE-2026-24679 is a heap-based buffer overflow vulnerability in FreeRDP's URBDRC (USB Redirection) client component, specifically in the libusb_udev_select_interface function. The flaw exists in all FreeRDP versions prior to 3.22.0, where server-supplied interface numbers are used as array indices into MsConfig->MsInterfaces[] without validating them against NumInterfaces. It was published on February 9, 2026, and fixed in FreeRDP 3.22.0. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 8.7 (High) (Red Hat Advisory, GitHub Advisory).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow) and CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input). In data_transfer.c, the function urb_select_interface parses an MSUSB_INTERFACE_DESCRIPTOR from the dynamic virtual channel stream and calls pdev->select_interface(pdev, MsInterface->InterfaceNumber, MsInterface->AlternateSetting) with an attacker-controlled InterfaceNumber. In libusb_udevice.c, libusb_udev_select_interface then directly indexes MsConfig->MsInterfaces[InterfaceNumber] without checking whether InterfaceNumber is less than MsConfig->NumInterfaces, resulting in an out-of-bounds heap read. The fix (commit 2d563a5) adds a bounds check: if (InterfaceNumber >= MsConfig->NumInterfaces) return -2; before the array access (GitHub Commit, GitHub Advisory).

A malicious or compromised RDP server can trigger a client-side heap buffer overflow in the URBDRC channel, causing the FreeRDP client to crash (denial of service) and potentially leaking heap memory contents (confidentiality impact). Depending on heap layout and allocator behavior, the out-of-bounds read could also facilitate heap corruption with code-execution risk. The vulnerability requires no authentication and no user interaction, making it exploitable against any FreeRDP client connecting to a malicious server with USB redirection enabled (GitHub Advisory, Red Hat Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.042%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack is network-based, requires no privileges or user interaction, and is exploitable whenever a FreeRDP client connects to a server with the URBDRC (USB redirection) channel active (GitHub Advisory, Red Hat Advisory).

1. Set up a malicious RDP server: Deploy a rogue or compromised RDP server that supports the URBDRC dynamic virtual channel (USB redirection), targeting FreeRDP clients running versions prior to 3.22.0.
2. Lure or intercept a client connection: Trick a victim into connecting to the malicious server (e.g., via phishing, DNS spoofing, or man-in-the-middle attack on an existing RDP session).
3. Negotiate URBDRC channel: During the RDP session, negotiate the USB redirection dynamic virtual channel (URBDRC) with the connecting FreeRDP client.
4. Send malicious USB configuration: Transmit a crafted TRANSFER_IN_REQUEST or SELECT_INTERFACE message over the URBDRC channel containing an MSUSB_INTERFACE_DESCRIPTOR with an InterfaceNumber value that exceeds the actual number of interfaces in the USB configuration descriptor.
5. Trigger heap buffer overflow: The FreeRDP client's libusb_udev_select_interface function indexes MsConfig->MsInterfaces[InterfaceNumber] out of bounds, causing a heap buffer overflow read — resulting in a crash (DoS) or potential memory disclosure (GitHub Advisory, GitHub Commit).

• Process: FreeRDP client process (xfreerdp, wfreerdp) crashing unexpectedly during an RDP session, particularly when USB redirection is enabled.
• Logs: AddressSanitizer or crash reports referencing libusb_udev_select_interface in channels/urbdrc/client/libusb/libusb_udevice.c; core dumps from the FreeRDP client process.
• Network: Unexpected or unsolicited RDP connections to unknown servers; URBDRC channel traffic containing SELECT_INTERFACE messages with anomalously large InterfaceNumber values.
• File System: Core dump files (e.g., core, xfreerdp.core) generated in the working directory of the FreeRDP client process following a crash.

Upgrade FreeRDP to version 3.22.0 or later, which includes the bounds check fix in libusb_udev_select_interface (GitHub Advisory, FreeRDP Release). Red Hat has issued patches for RHEL 7 through RHEL 10 across multiple errata (RHSA-2026:6340, RHSA-2026:6727, RHSA-2026:6743, RHSA-2026:6799, RHSA-2026:6918, and others) (Red Hat Bugzilla). Ubuntu has issued USN-8042-1, and openSUSE and Mageia have also released updated packages. As a workaround, disable USB redirection (URBDRC channel) in FreeRDP client configurations and restrict RDP client connections to trusted servers only.

The vulnerability was reported by security researcher ehdgks0627 and disclosed via the FreeRDP GitHub Security Advisory program on February 9, 2026 (GitHub Advisory). The FreeRDP project rated the severity as "Moderate" in their advisory despite the high CVSS score, noting that exploitation requires a client to connect to a malicious server with USB redirection active. Multiple Linux distributions including Red Hat, Ubuntu, openSUSE, Mageia, and Amazon Linux 2 issued security advisories and updated packages in the weeks following disclosure (Red Hat Bugzilla, Ubuntu Advisory).