CVE-2026-26965: 
NixOS vulnerability analysis and mitigation

CVE-2026-26965 is a heap out-of-bounds write vulnerability in FreeRDP's RLE planar bitmap decompression path, classified as CWE-787 (Out-of-bounds Write) / CWE-122 (Heap-based Buffer Overflow). It affects all FreeRDP versions prior to 3.23.0 and was disclosed on February 25, 2026. A malicious RDP server can exploit this to perform a heap OOB write with attacker-controlled offset and pixel data on any connecting FreeRDP client, potentially enabling control-flow hijacking and arbitrary code execution. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory).

The root cause is a missing destination bounds check in planar_decompress_plane_rle() within libfreerdp/codec/planar.c. The function writes into pDstData at offset ((nYDst+y) * nDstStep) + (4*nXDst) + nChannel without verifying that (nYDst+nSrcHeight) fits within the destination height or that (nXDst+nSrcWidth) fits within the destination stride. When TempFormat != DstFormat (e.g., when the NA bit is set, causing BGRX32 vs BGRA32 mismatch), pDstData is redirected to planar->pTempData — a desktop-sized scratch buffer — while nYDst is only validated against the smaller surface dimensions via is_within_surface(). The RAW decode path (planar_decompress_planes_raw()) contains equivalent bounds checks at lines 620–636, but these were absent from the RLE path. The fix, committed in a0be5cb, adds the missing nYDst + nSrcHeight > nTotalHeight and (nXDst + nSrcWidth) * bpp > nDstStep guards before entering the RLE branch (GitHub Commit, GitHub Advisory).

A malicious RDP server can trigger a heap buffer overflow write of up to 132,096 bytes past the end of pTempData on any connecting FreeRDP client, with attacker-controlled offset and pixel data. On systems where the desktop resolution is 128×128 or smaller (a server-controlled parameter via RDPGFX_RESET_GRAPHICS_PDU), pTempData is allocated on the brk heap below glibc's 128 KB mmap threshold, placing it contiguously with other codec structures. Under this deterministic heap layout, the OOB write can overwrite the NSC_CONTEXT.decode function pointer (demonstrated as 0xFF414141FF414141) and adjacent fields including Planes*, palette*, and priv*, enabling control-flow hijacking and potential arbitrary code execution. The attack requires only that a user connect to a malicious RDP server — no special privileges are needed on either side (GitHub Advisory).

A proof-of-concept exploit (ASAN-confirmed codec-level harness) is publicly available in the GitHub Security Advisory, demonstrating heap buffer overflow and function pointer overwrite with attacker-controlled values. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.039% (0.000390), indicating low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Set up a malicious RDP server: Configure a rogue RDP server that supports the RDP8 Graphics Pipeline (RDPGFX) and can serve PLANAR codec surface commands.
2. Control desktop size: Send an RDPGFX_RESET_GRAPHICS_PDU specifying a desktop resolution of 128×128 or smaller. This forces pTempData (96 KB) to be allocated on the brk heap below glibc's 128 KB mmap threshold, placing it adjacent to NSC_CONTEXT and other codec structures.
3. Create a large surface: Send RDPGFX_CREATE_SURFACE_PDU with a large surface (e.g., 4096×4096) using GFX_PIXEL_FORMAT_ARGB_8888. This ensures is_within_surface() passes for large nYDst values.
4. Craft a malicious PLANAR RLE bitmap: Build a valid RLE-encoded planar bitmap (e.g., 128×128 pixels) with the NA bit set in the format header (0x30), triggering the TempFormat != DstFormat condition that redirects writes to pTempData.
5. Set out-of-bounds destination offset: Specify nYDst=322 (for 128×128 desktop), which passes is_within_surface() against the large surface but causes nYDst + nSrcHeight = 450 > allocRows = 192, triggering the OOB write into adjacent heap memory.
6. Control written bytes via RLE delta encoding: Encode pixel values (e.g., B=G=R=0x41) in the RLE payload. Row 0 carries absolute values; subsequent rows use delta encoding (0x00 = delta 0, same as previous). With NA=1, the alpha byte is filled with 0xFF, producing 4-byte pixels of [0x41, 0x41, 0x41, 0xFF] and overwriting the 8-byte NSC_CONTEXT.decode function pointer with 0xFF414141FF414141.
7. Trigger code execution: When the client subsequently calls nsc_process_message() on the corrupted NSC_CONTEXT, the overwritten decode function pointer is invoked, redirecting control flow to the attacker-controlled address (GitHub Advisory).

• Network: Unexpected or unsolicited RDP connections to servers with unusually small desktop resolutions (128×128 or smaller) as reported in session negotiation; RDPGFX_RESET_GRAPHICS_PDU packets specifying very small desktop dimensions followed by large surface creation commands.
• Process: FreeRDP client process (xfreerdp, wfreerdp, or similar) crashing with segmentation faults or SIGSEGV shortly after connecting to an RDP server; crash dumps showing corrupted function pointers in NSC_CONTEXT structures (e.g., pointer values like 0xFF414141FF414141).
• Logs: ASAN or memory sanitizer output referencing planar_decompress_plane_rle at planar.c:436 or freerdp_bitmap_decompress_planar at planar.c:958; application crash logs from FreeRDP client with stack traces involving planar_decompress_plane_rle() and nsc_process_message().
• File System: Core dump files generated by FreeRDP client processes; unexpected child processes spawned from the FreeRDP client process following an RDP session.

The primary remediation is to upgrade FreeRDP to version 3.23.0 or later, which includes the fix committed in a0be5cb adding the missing destination bounds checks before the RLE decode path (GitHub Commit, GitHub Advisory). Linux distribution packages (Fedora, Ubuntu, RHEL/AlmaLinux/Oracle Linux, openSUSE, Debian, Mageia, Amazon Linux 2) have released updated packages incorporating this fix. As a workaround until patching is possible, restrict FreeRDP client connections to trusted, known-good RDP servers only, and avoid connecting to untrusted or unknown RDP endpoints. Disabling the RDP8 Graphics Pipeline (RDPGFX) via client configuration may also reduce exposure, though this may impact functionality.

The vulnerability was covered by The Hacker Wire shortly after disclosure, highlighting the heap overflow and RCE potential (The Hacker Wire). Multiple Linux distribution security teams (Red Hat, openSUSE, Ubuntu, Debian, AlmaLinux, Oracle Linux, Mageia, Amazon Linux) issued advisories and updated packages within weeks of the disclosure. The Phoronix community noted the FreeRDP 3.23.0 release addressing this and related issues (Phoronix). VulDB and infosec.exchange also tracked and discussed the vulnerability in the security community.