CVE-2026-26271: 
NixOS vulnerability analysis and mitigation

CVE-2026-26271 is a buffer overread vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol, affecting all versions prior to 3.23.0. The flaw resides in the freerdp_image_copy_from_icon_data() function (libfreerdp/codec/color.c) and can be triggered by crafted RDP Window Icon (TS_ICON_INFO) data sent over the network. It was published on February 25, 2026, and assigned a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-126 (Buffer Over-read) and CWE-805 (Buffer Access with Incorrect Length Value). In freerdp_image_copy_from_icon_data(), color data size (cbBitsColor) is validated against the expected pixel buffer size, but the mask data size (cbBitsMask) is never checked before use. When the destination format includes an alpha channel, the code computes a stride from nWidth/nHeight and iterates over bitsMask for stride * nHeight bytes — but if a server sends a small cbBitsMask (e.g., 1) with large nWidth/nHeight, the loop reads past the end of the allocated mask buffer. The parsing entry point update_read_icon_info() in libfreerdp/core/window.c only validates that the stream contains the declared byte counts, without enforcing consistency between cbBitsMask and the dimensions used in the mask loop (GitHub Advisory, Fix Commit).

Successful exploitation results in a denial of service condition due to the out-of-bounds read, causing the FreeRDP client process to crash or behave unexpectedly. There is no confidentiality or integrity impact associated with this vulnerability — only a low availability impact. The attack is reachable over the network from a malicious RDP server or a man-in-the-middle attacker without requiring authentication or user interaction (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit or in-the-wild exploitation has been observed as of the time of reporting. The CVSS v4.0 metadata indicates exploit maturity of "Proof of Concept," suggesting the vulnerability is well-understood technically, though no weaponized exploit is known. The EPSS score is approximately 0.042%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Set up a malicious RDP server: Configure a rogue RDP server (or perform a man-in-the-middle attack on an existing RDP session) capable of sending crafted Window Order (Rail) PDUs containing TS_ICON_INFO structures.
2. Craft a malicious TS_ICON_INFO payload: Construct a Window Icon order with a large nWidth and nHeight (e.g., 64x64), a bpp value of 32 (to trigger the alpha mask path), a cbBitsColor value large enough to pass the existing color data check, and a cbBitsMask value that is intentionally too small (e.g., 1 byte).
3. Lure or intercept the client connection: Direct a vulnerable FreeRDP client (version ≤ 3.22.0) to connect to the malicious server, or intercept an existing RDP session via MITM.
4. Trigger the overread: When the client processes the crafted icon data in freerdp_image_copy_from_icon_data(), the mask loop computes stride * nHeight bytes to read but only cbBitsMask bytes are allocated, causing an out-of-bounds read and resulting in a client crash (denial of service) (GitHub Advisory, Fix Commit).

• Process: Unexpected crash or segmentation fault of the FreeRDP client process (xfreerdp, wfreerdp, or similar) during an active RDP session, particularly when connecting to an untrusted server.
• Logs: Application crash logs or core dumps referencing freerdp_image_copy_from_icon_data() in libfreerdp/codec/color.c; error messages related to icon or mask data processing in FreeRDP debug output.
• Network: RDP traffic containing Window Order (Rail) PDUs with TS_ICON_INFO structures where cbBitsMask is disproportionately small relative to the declared nWidth and nHeight values; connections to unexpected or unknown RDP server IP addresses.

Upgrade FreeRDP to version 3.23.0 or later, which includes the fix introduced in commit f5e2040 that adds a proper length check for cbBitsMask before the mask loop executes. For systems where immediate patching is not feasible, restrict network access to trusted RDP servers only, implement network segmentation to limit exposure to potentially malicious RDP traffic, and avoid connecting to untrusted RDP endpoints. Monitor for unexpected FreeRDP client crashes as a potential indicator of exploitation attempts (GitHub Advisory, Fix Commit).

The vulnerability was reported by researcher LuiginoC and disclosed by the FreeRDP maintainer (akallabeth) via GitHub Security Advisories on February 25, 2026. Coverage has been picked up by Linux distribution security channels including Fedora, Ubuntu, openSUSE, Amazon Linux, Mageia, and Debian, all issuing updated packages. Technical coverage appeared on Phoronix in the context of the FreeRDP 3.23.0 release, and the issue was tracked by multiple vulnerability databases including VulDB and ENISA's EUVD (GitHub Advisory, Phoronix).