CVE-2026-25941: 
NixOS vulnerability analysis and mitigation

CVE-2026-25941 is an out-of-bounds read vulnerability in the FreeRDP client's RDPGFX channel, specifically in the handling of WIRE_TO_SURFACE_2 PDUs. A malicious RDP server can exploit this by sending a crafted PDU with a bitmapDataLength value larger than the actual data in the packet, causing the client to read uninitialized heap memory. Affected versions include FreeRDP 2.x prior to 2.11.8 and 3.x prior to 3.23.0. The vulnerability was published on February 25, 2026, and patched versions were released the same day. The GitHub Security Advisory assigns a CVSS v3.1 score of 4.3 (Moderate), while Feedly's aggregated data reflects a higher score of 8.1 (High) based on confidentiality and availability impact (GitHub Advisory).

The root cause is improper input validation (CWE-20) leading to an out-of-bounds read (CWE-125) in the rdpgfx_recv_wire_to_surface_2_pdu function in channels/rdpgfx/client/rdpgfx_main.c. The function reads bitmapDataLength from the incoming PDU and calls Stream_Seek() to advance the stream pointer by that amount without first validating that sufficient data exists in the stream — unlike the analogous rdpgfx_recv_wire_to_surface_1_pdu function, which correctly calls Stream_CheckAndLogRequiredLength() before seeking. In release builds, even the buffer-capacity assertion in Stream_Seek() is disabled, making the issue exploitable without triggering any runtime checks. The attack vector is network-based and requires user interaction (the victim must connect to a malicious RDP server), but no authentication on the server side is needed. A PoC demonstrating the issue with AddressSanitizer was included in the security advisory, showing a heap-buffer-overflow read of 240 bytes beyond a 37-byte valid PDU buffer (GitHub Advisory, Patch Commit).

Successful exploitation allows a malicious RDP server to read uninitialized heap memory from the connecting FreeRDP client, potentially exposing sensitive data such as credentials, session tokens, or other in-memory content (confidentiality impact). Additionally, the out-of-bounds read can cause the FreeRDP client to crash, resulting in a denial of service for the user (availability impact). There is no integrity impact, and the scope is limited to the affected client process; lateral movement from this vulnerability alone is not directly facilitated (GitHub Advisory).

A proof-of-concept exploit was published as part of the GitHub Security Advisory at the time of disclosure on February 25, 2026, demonstrating the heap-buffer-overflow with AddressSanitizer (GitHub Advisory). As of the available data, there is no evidence of active in-the-wild exploitation, and no threat actor attribution has been reported. The EPSS score is approximately 0.041% (0.000410), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Set up a malicious RDP server: Configure a rogue RDP server (e.g., using a custom RDP server implementation or a modified open-source server) that supports the RDPGFX channel and can send arbitrary PDUs to connecting clients.
2. Lure the victim to connect: Social-engineer a target user into connecting to the malicious RDP server using a FreeRDP client (versions 2.0.0–2.11.7 or 3.0.0–3.22.x).
3. Craft a malformed WIRE_TO_SURFACE_2 PDU: Construct a PDU with command ID 0x0002 containing:
   • A valid RDPGFX header (8 bytes)
   • Valid fixed fields: surfaceId, codecId, codecContextId, pixelFormat (13 bytes)
   • A bitmapDataLength field set to a large value (e.g., 256)
   • Actual bitmap data smaller than claimed (e.g., 16 bytes)
4. Send the malformed PDU: Transmit the crafted PDU to the FreeRDP client over the RDPGFX virtual channel during an active RDP session.
5. Trigger out-of-bounds read: The client's rdpgfx_recv_wire_to_surface_2_pdu function reads bitmapDataLength and calls Stream_Seek() without validation, causing downstream codec processing to read beyond the valid buffer into uninitialized heap memory.
6. Collect leaked data or cause crash: Depending on the heap layout, the attacker may receive leaked heap memory contents (information disclosure) or cause the client to crash (denial of service) (GitHub Advisory).

• Network: Unexpected or unsolicited RDP connections to external or unknown IP addresses initiated by a FreeRDP client; RDPGFX channel traffic containing WIRE_TO_SURFACE_2 PDUs (command ID 0x0002) with anomalously large bitmapDataLength values relative to actual packet size.
• Process: FreeRDP client process (xfreerdp, wfreerdp, or similar) crashing unexpectedly or exiting with memory access errors; AddressSanitizer output referencing rdpgfx_recv_wire_to_surface_2_pdu or rdpgfx_main.c in debug builds.
• Logs: Application crash logs or core dumps from the FreeRDP client process; system logs showing abnormal termination of RDP client sessions shortly after connection establishment to an unfamiliar server.

Upgrade FreeRDP to version 2.11.8 (for the 2.x branch) or 3.23.0 (for the 3.x branch), which add a Stream_CheckAndLogRequiredLength (or Stream_SafeSeek) validation before the Stream_Seek() call in rdpgfx_recv_wire_to_surface_2_pdu (Patch Commit). As an interim workaround, restrict users from connecting to untrusted or unknown RDP servers, and implement network controls (e.g., firewall rules or VPN policies) to limit RDP connections to known, trusted endpoints. Linux distribution users should apply vendor-provided package updates as they become available (e.g., Fedora, Ubuntu, SUSE, Debian, Amazon Linux 2 packages have been updated) (GitHub Advisory).

The vulnerability was reported by Pavel Kohout of Aisle Research and published via GitHub's security advisory system on February 25, 2026. Coverage appeared on Phoronix noting the FreeRDP 3.23 release, and Linux distribution security channels (Fedora, SUSE, Ubuntu, Debian, Amazon Linux) issued advisories and package updates in the weeks following disclosure. No significant independent researcher commentary or social media controversy has been observed beyond routine CVE tracking and distribution patching activity.