CVE-2026-24680: 
NixOS vulnerability analysis and mitigation

CVE-2026-24680 is a heap use-after-free vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol, affecting the SDL client's pointer handling code (sdl_Pointer_New/update_pointer_new). When sdl_Pointer_New fails during image copy, it frees ptr->data, but the caller update_pointer_new subsequently invokes pointer_free, which calls sdl_Pointer_Free and frees the same memory again, triggering a double-free/UAF condition. All FreeRDP versions prior to 3.22.0 are affected. The vulnerability was published on February 9, 2026, and carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (Red Hat Advisory, GitHub Advisory).

The root cause is a Use After Free (CWE-416) combined with an Expired Pointer Dereference (CWE-825) in the SDL client's pointer rendering path. In sdl_Pointer_New (client/SDL/SDL2/sdl_pointer.cpp), when freerdp_image_copy_from_pointer_data fails, the function frees ptr->data via winpr_aligned_free and returns FALSE. The caller update_pointer_new (libfreerdp/cache/pointer.c) then calls pointer_free on failure, which invokes sdl_Pointer_Free, which calls winpr_aligned_free(ptr->data) again on the already-freed heap region. The fix (commit c42ecbd) sets ptr->data = nullptr immediately after the first free, preventing the second free from operating on a dangling pointer. The vulnerability is triggered via a malicious RDP server sending a crafted POINTER_NEW_UPDATE PDU over the network (GitHub Advisory, GitHub Commit).

A malicious RDP server can trigger this vulnerability in a connecting FreeRDP SDL client, causing a heap use-after-free that results in a crash (denial of service). Depending on heap allocator behavior and surrounding heap layout, the double-free may also lead to heap corruption with potential for arbitrary code execution on the client system. There is no confidentiality or integrity impact under the standard CVSS assessment, but the availability impact is rated High. The vulnerability affects only FreeRDP clients using the SDL backend connecting to untrusted or attacker-controlled RDP servers (GitHub Advisory, Red Hat Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is remotely exploitable over the network without authentication or user interaction beyond the client initiating an RDP connection to a malicious server. The EPSS score is approximately 0.042% (0.000420), indicating low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The credited reporter is ehdgks0627 (GitHub Advisory).

1. Set up a malicious RDP server: Deploy a rogue RDP server (e.g., using a modified FreeRDP server or custom RDP implementation) that can send crafted POINTER_NEW_UPDATE PDUs to connecting clients.
2. Lure a victim client: Trick a user running FreeRDP (SDL client, versions < 3.22.0) into connecting to the malicious server — for example, via a phishing link, a compromised RDP shortcut file, or a man-in-the-middle attack on an existing RDP session.
3. Send a crafted POINTER_NEW_UPDATE PDU: Once the client connects, transmit a POINTER_NEW_UPDATE PDU containing pointer image data that causes freerdp_image_copy_from_pointer_data to fail (e.g., malformed XOR/AND mask data or invalid dimensions).
4. Trigger the UAF: The failure in sdl_Pointer_New causes ptr->data to be freed. The error path in update_pointer_new then calls pointer_free, which invokes sdl_Pointer_Free and frees ptr->data a second time, triggering the heap use-after-free.
5. Achieve DoS or potential code execution: The double-free corrupts the heap allocator state, causing the FreeRDP client to crash (DoS). With careful heap grooming, an attacker may be able to achieve arbitrary code execution on the client system (GitHub Advisory).

• Process: FreeRDP SDL client process (sdl-freerdp) crashing unexpectedly, particularly after connecting to an RDP server; crash dumps referencing winpr_aligned_free, sdl_Pointer_Free, or update_pointer_new in the stack trace.
• Logs: AddressSanitizer output (if enabled) showing heap-use-after-free at winpr_aligned_free in alignment.c; application crash logs from the FreeRDP SDL client process.
• Network: Unusual or repeated RDP connections to unknown or untrusted server IPs; RDP traffic containing malformed POINTER_NEW_UPDATE PDUs (detectable via deep packet inspection on port 3389).
• File System: Core dump files generated by the FreeRDP SDL client process in the working directory or system crash dump location.

The vulnerability is fixed in FreeRDP version 3.22.0, released January 28, 2026. Organizations should upgrade all FreeRDP installations (particularly those using the SDL client backend) to version 3.22.0 or later immediately. The specific fix (commit c42ecbd) sets ptr->data = nullptr after the initial free in sdl_Pointer_New, preventing the subsequent double-free. Downstream distributions including Ubuntu (USN-8042-1), Fedora, openSUSE, Mageia, and Debian have also released updated packages. As a temporary workaround where patching is not immediately possible, restrict FreeRDP clients to connecting only to trusted, known-good RDP servers (GitHub Advisory, GitHub Commit, Ubuntu Advisory).

The vulnerability was reported by security researcher ehdgks0627 and published via the FreeRDP GitHub Security Advisory program. Red Hat tracked the issue as medium severity in their Bugzilla system. Multiple Linux distributions (Ubuntu, Fedora, openSUSE, Mageia, Debian) issued security advisories and updated packages shortly after disclosure. Community coverage was primarily limited to distribution security mailing lists and vulnerability aggregator sites, with no notable broader media coverage (GitHub Advisory, Red Hat Bugzilla, Ubuntu Advisory).