CVE-2026-24682: 
NixOS vulnerability analysis and mitigation

CVE-2026-24682 is a heap-based buffer overflow vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol, affecting all versions prior to 3.22.0. The flaw resides in the audin_server_recv_formats function, which incorrectly frees audio format entries using i + i instead of i on parse failure, causing out-of-bounds access in audio_formats_free. It was disclosed on February 9, 2026, with a fix released in FreeRDP 3.22.0. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an incorrect calculation of the buffer size during error-path cleanup in audin_server_recv_formats (CWE-122: Heap-based Buffer Overflow; CWE-131: Incorrect Calculation of Buffer Size). The function allocates NumFormats entries for pdu.SoundFormats, then iterates to parse each AUDIO_FORMAT. On parse failure at index i, it calls audio_formats_free(pdu.SoundFormats, i + i) — doubling the intended count — causing audio_formats_free to iterate past the end of the allocated array and invoke audio_format_free on out-of-bounds memory. The fix (commit 1c5c742) replaces the erroneous cleanup block with a goto fail pattern that correctly handles the count. No authentication or user interaction is required to trigger this condition, as a malicious RDP client can send crafted audio format data to a vulnerable server (GitHub Advisory, GitHub Commit).

Successful exploitation primarily results in a denial of service by crashing the FreeRDP process due to heap corruption triggered by the out-of-bounds read/free. Depending on heap layout and allocator behavior, the heap buffer overflow could potentially be leveraged for arbitrary code execution with the privileges of the FreeRDP process, though this is considered a secondary risk. The GitHub security advisory confirms that a malicious client can trigger a server-side crash (DoS) with potential heap corruption and code-execution risk (GitHub Advisory). There is no impact on confidentiality or integrity under the primary exploitation scenario.

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The vulnerability was reported by researcher ehdgks0627 and is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.042% (0.000420), indicating a low probability of exploitation in the near term. The attack requires no authentication and no user interaction, making it trivially automatable against exposed FreeRDP server instances if a weaponized exploit were developed.

1. Reconnaissance: Identify internet-facing FreeRDP server instances (e.g., using Shodan or Censys) running versions prior to 3.22.0 that expose the audio input (audin) virtual channel.
2. Establish RDP connection: Connect to the target FreeRDP server as an RDP client, initiating the virtual channel negotiation phase.
3. Trigger audin channel: Initiate the audio input (audin) virtual channel handshake, causing the server to invoke audin_server_recv_formats to parse client-supplied audio format data.
4. Send malformed audio format data: Craft a malicious AUDIO_FORMATS PDU with a NumFormats value and audio format entries designed to cause audio_format_read to fail at a specific index i, triggering the buggy cleanup path audio_formats_free(pdu.SoundFormats, i + i).
5. Trigger heap buffer overflow: The server calls audio_formats_free with a count of i + i, iterating past the end of the allocated SoundFormats array and accessing out-of-bounds heap memory, resulting in a crash (DoS) or potential heap corruption (GitHub Advisory, GitHub Commit).

• Process: Unexpected crash or termination of the FreeRDP server process (freerdp-shadow-cli or similar), particularly with AddressSanitizer output referencing audio_format_free or audio_formats_free in stack traces.
• Logs: FreeRDP server logs showing WLOG_ERROR entries for "Failed to read audio format" followed immediately by process termination; core dump files generated by the FreeRDP server process.
• Network: Unusual or repeated RDP connection attempts from a single source IP that terminate abnormally during the virtual channel negotiation phase; connections that initiate the audin channel with malformed PDU data.
• File System: Core dump files (e.g., core.*) in the FreeRDP working directory following unexpected process crashes.

The primary remediation is to upgrade FreeRDP to version 3.22.0 or later, which contains the fix in commit 1c5c742 (GitHub Commit). Red Hat has addressed this issue via errata RHSA-2026:6743 (RHEL 10.0 EUS), RHSA-2026:6799 (RHEL 10), and RHSA-2026:19033 (RHEL 10) (Red Hat Bugzilla). Ubuntu addressed it via USN-8042-1. If immediate patching is not possible, restrict network access to FreeRDP services using firewall rules to limit exposure to untrusted networks, and disable the audio input (audin) virtual channel if it is not required.

The FreeRDP project published a release announcement for version 3.22.0 on January 28, 2026, which included fixes for this and other vulnerabilities (FreeRDP Release). The vulnerability was discussed on the oss-security mailing list and picked up by Linux distribution security teams including Red Hat, Ubuntu, Fedora, openSUSE, Mageia, and Debian, all of which issued advisories or package updates. Community coverage was largely routine, with no significant controversy or notable researcher commentary beyond the original reporter (ehdgks0627) and standard distribution security announcements.