CVE-2026-24684: 
NixOS vulnerability analysis and mitigation

CVE-2026-24684 is a heap use-after-free vulnerability in FreeRDP's RDPSND (Remote Desktop Protocol Sound) async playback thread, formally titled "Heap-use-after-free in play_thread." It affects all FreeRDP versions prior to 3.22.0 and was disclosed on February 9, 2026. The flaw allows a malicious RDP server to trigger a client-side crash or potential heap corruption. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (Red Hat Advisory, GitHub Advisory).

The root cause is a race condition classified as CWE-416 (Use After Free) and CWE-131 (Incorrect Calculation of Buffer Size). In async mode, rdpsnd_on_data_received posts incoming PDUs to a message queue consumed by play_thread. When rdpsnd_on_close is called, it frees the device and internal state (including rdpsnd->device and format arrays) while play_thread may still be dequeuing and processing messages — ultimately calling rdpsnd_treat_wave, which dereferences the already-freed rdpsnd->device pointer. The fix introduces a rdpsnd_terminate_thread function that signals the queue with a quit message and waits for the thread to exit before releasing channel context memory, ensuring proper synchronization (GitHub Advisory, Patch Commit 1, Patch Commit 2).

Successful exploitation causes a client-side heap use-after-free, resulting in a crash of the FreeRDP client process (denial of service). Depending on heap allocator behavior and surrounding heap layout, the vulnerability also carries a risk of heap corruption that could theoretically lead to arbitrary code execution on the connecting client. Confidentiality and integrity impacts are rated None in the CVSS scoring, with the primary confirmed impact being availability loss of the RDP session (GitHub Advisory, Red Hat Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability is network-exploitable without authentication or user interaction, requiring only that a victim FreeRDP client connect to a malicious RDP server. The EPSS score is approximately 0.04% (0.000400), indicating low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat Advisory, GitHub Advisory).

1. Setup a malicious RDP server: Configure a rogue RDP server (e.g., using a custom RDP server implementation) that supports the RDPSND dynamic virtual channel and is capable of sending crafted sound PDUs.
2. Lure the victim client: Induce a FreeRDP client running a version prior to 3.22.0 to connect to the malicious server (e.g., via phishing, DNS spoofing, or man-in-the-middle positioning).
3. Negotiate RDPSND channel: During the RDP session setup, negotiate the RDPSND dynamic virtual channel so that the client initializes the async playback thread (play_thread) and message queue.
4. Send sound PDUs: Transmit RDPSND wave PDUs to the client, which are posted to the async message queue and processed by play_thread via rdpsnd_recv_pdu → rdpsnd_treat_wave.
5. Trigger channel close race: Send a channel close request (drdynvc_process_close_request) while play_thread is still processing queued PDUs, causing rdpsnd_on_close to free rdpsnd->device and internal state.
6. Trigger use-after-free: The still-running play_thread dereferences the freed rdpsnd->device pointer in rdpsnd_treat_wave at rdpsnd_main.c:636, causing a heap use-after-free — resulting in a crash (DoS) or potential code execution depending on heap state (GitHub Advisory).

• Process: FreeRDP client process (xfreerdp, wfreerdp) crashing unexpectedly or producing AddressSanitizer-style abort messages referencing rdpsnd_treat_wave or play_thread.
• Logs: Application crash logs or core dumps showing stack traces involving rdpsnd_treat_wave, rdpsnd_recv_wave2_pdu, rdpsnd_recv_pdu, or play_thread in rdpsnd_main.c.
• Network: Outbound RDP connections (TCP port 3389 or dynamic ports) to unfamiliar or untrusted server IP addresses, particularly if followed immediately by client process termination.
• File System: Core dump files generated by the FreeRDP client process in the working directory or system crash directory (e.g., /var/crash/, /tmp/) shortly after an RDP session attempt.

The primary remediation is to upgrade FreeRDP to version 3.22.0 or later, which contains the fix via commits 622bb7b and afa6851 that ensure the async playback thread is properly terminated before channel memory is freed. Linux distribution patches have been issued by Red Hat (RHSA-2026:6340, RHSA-2026:6727, RHSA-2026:6743, RHSA-2026:6799, RHSA-2026:6918, and others), Ubuntu (USN-8042-1), openSUSE, Mageia, Amazon Linux 2, and AlmaLinux. As a temporary workaround where patching is not immediately possible, restrict network access to RDP services and avoid connecting FreeRDP clients to untrusted RDP servers (Red Hat Advisory, Red Hat Bugzilla, FreeRDP Release).

The FreeRDP project published a security advisory (GHSA-vcgv-xgjp-h83q) and released version 3.22.0 on January 28, 2026, crediting researcher ehdgks0627 for the discovery. Red Hat issued multiple errata across RHEL 7 through 10 product lines, reflecting broad downstream impact. The vulnerability received routine coverage from Linux security news aggregators and distribution security lists (Ubuntu, openSUSE, Mageia, Fedora, AlmaLinux), with no notable controversy or significant social media discussion beyond standard patch announcements (GitHub Advisory, FreeRDP Release, Red Hat Bugzilla).