CVE-2026-26986: 
NixOS vulnerability analysis and mitigation

CVE-2026-26986 is a heap use-after-free vulnerability in FreeRDP's X11 RAIL (Remote Application Integrated Locally) client implementation, specifically in the rail_window_free function. The flaw affects all FreeRDP versions prior to 3.23.0 and was disclosed on February 25, 2026. A malicious RDP server can trigger the bug remotely without authentication or user interaction, causing a client-side crash and potential heap corruption. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 5.5 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is a use-after-free (CWE-416) combined with an expired pointer dereference (CWE-825) in client/X11/xf_rail.c. When a new RAIL window order is received, xf_rail_add_window allocates an xfAppWindow struct and inserts it into the railWindows hash table. If the subsequent window title allocation fails — either because _strdup("RdpRailWindow") returns NULL under memory pressure, or because ConvertWCharNToUtf8Alloc rejects malformed UTF-16 (e.g., a lone low surrogate U+DC00, bytes 0x00 0xDC) sent by the server — the error path calls free(appWindow) without first removing the entry from the hash table. This leaves a dangling pointer in railWindows. On disconnect, xf_rail_uninit calls HashTable_Free(xfc->railWindows), which iterates all entries and invokes the rail_window_free destructor, dereferencing the already-freed appWindow pointer and triggering a heap-use-after-free. The server-controlled trigger path (Path A) requires the client to be built with WITH_UNICODE_BUILTIN=ON, as the ICU backend tolerates malformed UTF-16 by substituting replacement characters (GitHub Advisory, Patch Commit).

Successful exploitation causes a client-side crash (denial of service) by corrupting the heap during RDP session teardown. The primary confirmed impact is availability loss — the FreeRDP client process terminates abnormally, disrupting active RDP sessions. Depending on heap allocator behavior and surrounding heap layout, the vulnerability also carries a theoretical risk of heap corruption that could lead to arbitrary code execution on the client system, though this has not been demonstrated in practice. Confidentiality and integrity are not directly affected under normal exploitation conditions (GitHub Advisory).

A proof-of-concept exploit path is publicly documented in the GitHub Security Advisory, demonstrating the crash via AddressSanitizer output. The server-controlled trigger (Path A) requires no client-side modification and no authentication — a malicious RDP server need only send a RAIL window create order with a malformed UTF-16 title (e.g., lone surrogate U+DC00) to clients built with WITH_UNICODE_BUILTIN=ON. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.049% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA KEV catalog. No threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Setup a malicious RAIL-capable RDP server: Configure or modify an RDP server to support the Remote Application Integrated Locally (RAIL) extension and send crafted window order PDUs to connecting clients.
2. Craft a malformed RAIL window create order: Prepare a window order PDU with WINDOW_ORDER_STATE_NEW and WINDOW_ORDER_FIELD_TITLE flags set, where the title data contains malformed UTF-16 — specifically a lone low surrogate (U+DC00, bytes 0x00 0xDC in little-endian). This causes ConvertWCharNToUtf8Alloc to return NULL on clients built with WITH_UNICODE_BUILTIN=ON.
3. Wait for client connection: A victim using xfreerdp connects to the malicious server (e.g., xfreerdp /v:<attacker_ip> /u:a /p:a /cert:ignore /app:program:notepad.exe).
4. Trigger the allocation failure: The client receives the crafted window order; the builtin Unicode converter rejects the unpaired surrogate, ConvertWCharNToUtf8Alloc returns NULL, and free(appWindow) executes without removing the entry from the railWindows hash table.
5. Trigger the use-after-free on disconnect: When the RDP connection is terminated (by the server or client), xf_rail_uninit calls HashTable_Free(xfc->railWindows), which invokes rail_window_free on the dangling pointer, causing a heap-use-after-free crash (GitHub Advisory).

• Logs: FreeRDP client log messages containing "failed to convert window title" or "failed to duplicate default window title string" immediately before a crash, indicating the title allocation failure path was triggered.
• Process: Abnormal termination of the xfreerdp process with a segmentation fault or heap corruption error; AddressSanitizer output showing heap-use-after-free in rail_window_free at xf_rail.c:1237 if the binary was built with ASan.
• Network: RDP traffic from a server sending RAIL window order PDUs (WINDOW_ORDER_STATE_NEW | WINDOW_ORDER_FIELD_TITLE) containing non-standard or malformed UTF-16 sequences in the title field, particularly bytes 0x00 0xDC (lone low surrogate U+DC00) in the title data.
• File System: Core dump files generated by the xfreerdp process in the working directory or system core dump location following an unexpected crash during or after an RDP session (GitHub Advisory).

The fix is available in FreeRDP version 3.23.0, which removes the erroneous free(appWindow) call from the error path in xf_rail_window_common, leaving cleanup to the hash table destructor (rail_window_free) instead. All users of FreeRDP prior to 3.23.0 should upgrade immediately. As a temporary workaround where upgrading is not immediately possible, organizations can restrict RDP client connections to trusted servers only via network segmentation and firewall rules, reducing exposure to malicious RAIL servers. Downstream Linux distributions including Red Hat, AlmaLinux, Rocky Linux, Ubuntu, SUSE, Debian, and Amazon Linux 2 have issued updated packages (Patch Commit, Red Hat Errata, GitHub Advisory).

The vulnerability was reported by researcher ehdgks0627 and published by FreeRDP maintainer akallabeth via GitHub Security Advisory on February 25, 2026. The advisory received moderate attention from the Linux security community, with downstream distributions (Red Hat, SUSE, Ubuntu, Debian, Rocky Linux, AlmaLinux, Amazon Linux 2) promptly issuing patched packages. Security news aggregators including LinuxSecurity.com and pro-linux.de covered the patch releases. No significant social media controversy or broader threat actor discussion has been observed (GitHub Advisory).