CVE-2026-24683: 
NixOS vulnerability analysis and mitigation

CVE-2026-24683 is a heap use-after-free vulnerability in FreeRDP's ainput_send_input_event function, classified as Heap-use-after-free in ainput_send_input_event. It affects all FreeRDP versions prior to 3.22.0 and was disclosed on February 9, 2026. The flaw arises from a race condition between the input event handler and a concurrent channel close operation. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Red Hat CVE).

The root cause is a missing synchronization primitive (CWE-416: Use After Free; CWE-825: Expired Pointer Dereference) in channels/ainput/client/ainput_main.c. The function ainput_send_input_event reads ainput->base.listener_callback->channel_callback into a local variable and subsequently calls callback->channel->Write() without holding any lock. Concurrently, ainput_on_close — triggered by a server-initiated channel close via drdynvc_process_close_request — calls free(callback) on the same pointer. If the close races with the write, the freed memory is accessed, producing a heap-use-after-free. The fix (commit d9ca272) introduces a CRITICAL_SECTION lock in the AINPUT_PLUGIN struct, acquired in both ainput_send_input_event and ainput_on_close to serialize access (GitHub Commit, GitHub Advisory).

A malicious RDP server can trigger this race condition on a connecting FreeRDP client, causing a crash (denial of service) due to heap corruption. Depending on allocator behavior and heap layout, the use-after-free could theoretically be escalated to arbitrary code execution on the client system, though the primary confirmed impact is availability loss. Confidentiality and integrity are not directly impacted under the standard CVSS assessment, but heap corruption primitives carry inherent code-execution risk in practice (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.042%, reflecting low near-term exploitation probability. Exploitation requires the attacker to control or impersonate an RDP server and to win a timing race between channel close and input event processing, adding practical complexity (GitHub Advisory, Feedly).

1. Set up a malicious RDP server: Deploy a rogue RDP server (e.g., using a modified FreeRDP server build or a custom implementation) that supports the AINPUT dynamic virtual channel.
2. Lure the client to connect: Trick a user running a vulnerable FreeRDP client (version < 3.22.0) into connecting to the malicious server, e.g., via a crafted RDP file or social engineering.
3. Establish the AINPUT channel: Allow the RDP session to negotiate and open the AINPUT dynamic virtual channel, causing the client to allocate a GENERIC_CHANNEL_CALLBACK for the channel.
4. Trigger concurrent channel close: Send a CLOSE_REQUEST for the AINPUT channel from the server side (via drdynvc_process_close_request), which causes the client's ainput_on_close to call free(callback) on the channel callback structure.
5. Race with input event: Simultaneously (or immediately before/after), cause the client to generate an input event (e.g., mouse movement) that triggers ainput_send_input_event, which reads the now-freed channel_callback pointer and calls callback->channel->Write() on freed memory.
6. Achieve DoS or heap corruption: The use-after-free causes a crash (DoS) or, under favorable heap conditions, may allow heap layout manipulation for further exploitation (GitHub Advisory, GitHub Commit).

• Process: Unexpected crash or abort of the FreeRDP client process (xfreerdp, wfreerdp, etc.), particularly with AddressSanitizer output referencing ainput_send_input_event in ainput_main.c.
• Logs: Core dump files or crash reports from the FreeRDP client process; application logs showing ABORTING or heap-use-after-free errors near the ainput channel code path.
• Network: Outbound RDP connections (TCP/3389 or custom port) to unfamiliar or untrusted server IP addresses, especially if followed immediately by client process termination.
• File System: Unexpected core dump files (e.g., core, xfreerdp.core) in the working directory of the FreeRDP client process (GitHub Advisory).

Upgrade FreeRDP to version 3.22.0 or later, which contains the fix (commit d9ca272) that introduces a CRITICAL_SECTION lock to serialize access to the channel callback (GitHub Commit, FreeRDP Release). Red Hat has issued patches for RHEL 8, 9, 9.4 EUS, 9.6 EUS, 10, and 10.0 EUS via errata RHSA-2026:6340, RHSA-2026:6727, RHSA-2026:6743, RHSA-2026:6799, RHSA-2026:6918, RHSA-2026:6958, and RHSA-2026:19033 (Red Hat Bugzilla). Ubuntu has issued USN-8042-1, and openSUSE, Mageia, Amazon Linux 2, and AlmaLinux have also released updated packages. As a temporary workaround for systems that cannot be immediately patched, restrict FreeRDP client connections to trusted RDP servers only using network-level access controls, and avoid connecting to untrusted or unknown RDP endpoints.

The vulnerability was reported by security researcher ehdgks0627 and disclosed via the FreeRDP GitHub Security Advisory on February 9, 2026 (GitHub Advisory). The FreeRDP project rated the severity as Moderate and released the fix in version 3.22.0 on January 28, 2026, ahead of the CVE publication. Multiple Linux distributions including Red Hat, Ubuntu, openSUSE, Mageia, and AlmaLinux issued coordinated security advisories, indicating broad ecosystem awareness. No significant social media controversy or threat actor commentary has been observed.