CVE-2026-24681: 
NixOS vulnerability analysis and mitigation

CVE-2026-24681 is a heap use-after-free vulnerability in FreeRDP's URBDRC (USB Redirection) channel, specifically in the urb_bulk_transfer_cb / urb_write_completion code path. It affects all FreeRDP versions prior to 3.22.0 and was disclosed on February 9, 2026, with a fix released in FreeRDP 3.22.0. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (Red Hat Advisory, GitHub Advisory).

The root cause is a race condition (CWE-416: Use After Free; CWE-825: Expired Pointer Dereference) in FreeRDP's URBDRC channel handling. When bulk or interrupt USB transfers are initiated, the channel callback pointer is passed to libusb as the completion handler (urb_bulk_transfer_cb). If the URBDRC channel is closed while transfers are still in flight, urbdrc_on_close frees the channel callback struct, but the asynchronous libusb completion thread may still invoke urb_bulk_transfer_cb → urb_write_completion, which dereferences the now-freed callback->plugin and callback->channel fields. The fix adds a call to cancel_all_transfer_request in libusb_udev_mark_channel_closed before unregistering the device, ensuring all in-flight transfers are cancelled before the callback is freed (GitHub Advisory, GitHub Commit).

A malicious RDP server can trigger this vulnerability on a connecting FreeRDP client by closing the URBDRC channel while USB bulk transfers are in progress, causing a heap use-after-free. The primary impact is a denial of service (process crash), but the advisory notes potential heap corruption with code-execution risk depending on allocator behavior and surrounding heap layout. Confidentiality and integrity are not directly impacted under normal exploitation, but the availability of the FreeRDP client process is fully compromised (GitHub Advisory, Red Hat Advisory).

No public proof-of-concept exploit code has been confirmed, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.042%, indicating low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to control or impersonate an RDP server that the victim client connects to, making opportunistic mass exploitation less likely (GitHub Advisory, Red Hat Advisory).

1. Set up a malicious RDP server: The attacker configures a rogue RDP server (e.g., using a modified FreeRDP server build) that supports the URBDRC dynamic virtual channel for USB redirection.
2. Lure the victim client to connect: The attacker tricks a user running a vulnerable FreeRDP client (version < 3.22.0) into connecting to the malicious server, for example via phishing or a man-in-the-middle attack.
3. Initiate USB redirection: The server negotiates the URBDRC channel and initiates bulk or interrupt USB transfer requests to the client, causing the client to register asynchronous libusb transfer callbacks.
4. Trigger channel close during in-flight transfers: The server sends a channel close request (DRDYNVC close) while USB bulk transfers are still pending asynchronously on the client side.
5. Trigger use-after-free: The client's urbdrc_on_close frees the channel callback struct, but the libusb polling thread completes the pending transfer and calls urb_bulk_transfer_cb → urb_write_completion, dereferencing the freed memory, causing a crash (DoS) or potential heap corruption (GitHub Advisory).

• Process: FreeRDP client process (xfreerdp, wfreerdp) crashes unexpectedly, particularly when USB redirection (URBDRC) is in use; AddressSanitizer output referencing urb_write_completion or urb_bulk_transfer_cb in crash logs.
• Logs: Application crash logs or core dumps showing stack traces involving urb_write_completion, urb_bulk_transfer_cb, func_bulk_transfer_cb, or urbdrc_on_close in data_transfer.c or libusb_udevice.c.
• Network: Unexpected or repeated RDP connections to unfamiliar server IPs, particularly servers that initiate URBDRC channel activity followed by abrupt channel closure.

The vulnerability is fixed in FreeRDP version 3.22.0; all users should upgrade immediately (FreeRDP Release). Red Hat has issued patches for RHEL 8, 9, 9.4 EUS, 9.6 EUS, 10, and 10.0 EUS via errata RHSA-2026:6340, RHSA-2026:6727, RHSA-2026:6743, RHSA-2026:6799, RHSA-2026:6918, RHSA-2026:6958, RHSA-2026:9640, and RHSA-2026:19033 (Red Hat Bugzilla). Ubuntu has issued USN-8042-1, and openSUSE, Mageia, Amazon Linux 2, and AlmaLinux have also released updates. As a workaround for systems that cannot be immediately patched, disable USB redirection (URBDRC) in FreeRDP configurations and restrict client connections to trusted RDP servers only.

The vulnerability was reported by security researcher ehdgks0627 and published by the FreeRDP maintainer (akallabeth) via GitHub Security Advisories on February 9, 2026 (GitHub Advisory). Multiple Linux distributions including Red Hat, Ubuntu, openSUSE, Mageia, and AlmaLinux responded promptly with security updates. The issue was also discussed on the oss-security mailing list (oss-sec). Community reaction has been measured, consistent with a moderate-severity client-side DoS vulnerability with no confirmed in-the-wild exploitation.