CVE-2026-26955: 
NixOS vulnerability analysis and mitigation

CVE-2026-26955 is a heap out-of-bounds write vulnerability in FreeRDP's ClearCodec surface command handler that allows a malicious RDP server to achieve remote code execution on connecting clients. It affects all FreeRDP versions prior to 3.23.0 (confirmed on 3.22.0). The vulnerability was published on February 25, 2026, with a patch released in FreeRDP 3.23.0. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Red Hat CVE).

The root cause (CWE-787: Out-of-bounds Write / CWE-122: Heap-based Buffer Overflow) is the absence of an is_within_surface() bounds check in gdi_SurfaceCommand_ClearCodec() in gfx.c. While four other GFX surface command handlers (Uncompressed, Planar, Alpha, Progressive) all call is_within_surface() before processing, the ClearCodec handler passes attacker-controlled cmd->left and cmd->top values directly to clear_decompress() without validation. These unchecked offsets propagate through clear_decompress_subcodecs_data() → clear_decompress_nscodec() → nsc_process_message() → freerdp_image_copy_no_overlap(), resulting in a heap OOB write into surface->data. The OOB write can corrupt an adjacent gdiGfxSurface struct's codecs* pointer with attacker-controlled pixel data, and a subsequent codec command on the corrupted surface reaches an indirect function pointer call at NSC_CONTEXT.decode (nsc.c:500), enabling full RIP control (GitHub Advisory, Patch Commit).

Successful exploitation allows a malicious RDP server to cause a heap buffer overflow in any FreeRDP client using the GDI surface pipeline (e.g., xfreerdp), with demonstrated end-to-end heap OOB write confirmed via ASan traces. The attacker controls the write offset (via cmd->left/cmd->top), write data (pixel values), and write size (subcodec dimensions), enabling corruption of adjacent heap structures and full instruction pointer (RIP) control — making remote code execution plausible. The impact is rated High for confidentiality, integrity, and availability, with potential for complete system compromise at the privilege level of the user running the RDP client (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, including standalone C harnesses, a Python PDU generator, and a rogue FreeRDP shadow server reproducer that demonstrates end-to-end exploitation from a malicious server to a crashing xfreerdp client. No evidence of in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.039% (low probability of near-term exploitation). The vulnerability is not listed in the CISA KEV catalog. Exploitation requires user interaction — the victim must connect to an attacker-controlled RDP server (e.g., via a crafted .rdp file or phished RDP link) (GitHub Advisory).

1. Set up a malicious RDP server: Deploy a rogue FreeRDP shadow server (or equivalent) with RDPGFX channel support, patched to inject exploit PDUs instead of normal screen sharing.
2. Lure the victim to connect: Deliver a crafted .rdp file, phished RDP link, or compromised RDP gateway URL to cause the target user to connect to the malicious server using xfreerdp or another FreeRDP GDI-pipeline client.
3. Heap grooming: Send two sequential RDPGFX_CREATE_SURFACE_PDU commands creating small surfaces (e.g., 32×32 ARGB). On glibc ptmalloc2, this places surface B's struct immediately after surface A's pixel data buffer, with surface B's codecs* pointer at a predictable offset past the end of surface A's data.
4. Trigger OOB write: Send a ClearCodec surface command targeting surface A with left=32 (equal to the surface width) and an NSCodec subcodec rectangle (e.g., width=16, height=32). Because gdi_SurfaceCommand_ClearCodec() omits the is_within_surface() check, the command is accepted and freerdp_image_copy_no_overlap() writes 64 bytes starting at byte 4096 — past the end of surface A's heap allocation — overwriting surface B's codecs* pointer with attacker-controlled pixel data.
5. Trigger corrupted pointer dereference: Send any subsequent codec command targeting surface B. The handler dereferences the corrupted codecs* pointer, traversing the chain codecs->clear[+32] → clear->nsc[+8] → nsc->decode[+96], reaching an indirect function pointer call at nsc.c:500 with attacker-controlled RIP.
6. Achieve code execution: With RIP control established, leverage heap spray of fake struct chains (via additional GFX surface pixel data) to redirect decode() to a ROP gadget or shellcode, bypassing ASLR/NX as applicable to the target platform (GitHub Advisory).

• Network: Unexpected or unsolicited RDP connections to external or unknown servers initiated by client workstations; RDPGFX dynamic virtual channel traffic (drdynvc) containing RDPGFX_CREATE_SURFACE_PDU sequences followed by ClearCodec surface commands with anomalous left/top values equal to or exceeding surface dimensions.
• Process: xfreerdp or other FreeRDP client processes crashing unexpectedly (segmentation fault, SIGBUS, or SIGABRT) shortly after connecting to an RDP server; unusual child processes spawned from FreeRDP client processes.
• Logs: Application crash logs or core dumps referencing gdi_SurfaceCommand_ClearCodec (gfx.c:485), nsc_process_message (nsc.c:507), or freerdp_image_copy_no_overlap; ASan reports of heap-buffer-overflow WRITE in FreeRDP processes.
• File System: Unexpected core dump files (core.*) in the working directory of FreeRDP client processes; new or modified files created by the FreeRDP process user account following an RDP session to an untrusted server.

Upgrade all FreeRDP installations to version 3.23.0 or later, which adds the missing is_within_surface() validation to gdi_SurfaceCommand_ClearCodec() and fixes destination checks in clear_decompress_subcodecs_data() (Patch Commit). As a temporary workaround, restrict RDP client connections to trusted, known-good servers only and avoid connecting to untrusted or unknown RDP endpoints. RDPGFX can be disabled entirely via the /gfx:off flag in xfreerdp, which prevents the vulnerable code path from being reached. Downstream distributions including Red Hat, Ubuntu, openSUSE, Fedora, Debian, Amazon Linux 2, Oracle Linux, AlmaLinux, and Mageia have issued updated packages (Red Hat Advisory, GitHub Advisory).

The vulnerability was covered by The Hacker Wire, which highlighted the heap overflow and RCE potential (The Hacker Wire). Phoronix reported on the FreeRDP 3.23.0 release that included the fix (Phoronix). Multiple Linux distribution security teams (Red Hat, Ubuntu, openSUSE, Fedora, Debian, AlmaLinux, Mageia, Oracle Linux, Amazon Linux) issued advisories and updated packages, indicating broad industry attention to the patch. The detailed advisory with full PoC harnesses and ASan traces published by the reporter on GitHub received significant scanner coverage, with Nessus and Qualys both adding detection plugins shortly after disclosure.