CVE-2026-27950: 
NixOS vulnerability analysis and mitigation

CVE-2026-27950 is a heap-use-after-free vulnerability in FreeRDP's SDL2 client implementation, resulting from an incomplete fix for the previously disclosed CVE-2026-24680. The prior fix was applied only to the SDL3 code path, leaving the SDL2 implementation (sdl_pointer.cpp) with a dangling pointer that is not nulled after being freed in the sdl_Pointer_New() function. All FreeRDP versions prior to 3.23.0 using SDL2 builds are affected. Disclosed on February 25, 2026, it carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-416 (Use After Free) and CWE-825 (Expired Pointer Dereference). In client/SDL/SDL2/sdl_pointer.cpp, within the sdl_Pointer_New() function, winpr_aligned_free(ptr->data) is called on failure, but ptr->data is not subsequently set to nullptr. This leaves a dangling pointer that can be dereferenced in subsequent operations, triggering a heap-use-after-free condition. The vulnerability is exploitable over the network with no authentication, no user interaction, and low attack complexity — a malicious RDP server could trigger the vulnerable code path during pointer update handling. The fix (commit 5f62aa1) adds a single line ptr->data = nullptr; after the free call in the SDL2 path, mirroring the fix already applied to SDL3 (commit c42ecbd) (GitHub Advisory, Fix Commit SDL2).

Successful exploitation causes a denial of service by crashing the FreeRDP client session through a heap-use-after-free condition. The impact is limited to availability — there is no confidentiality or integrity compromise identified. Affected environments include any system running FreeRDP prior to version 3.23.0 that was built against SDL2, which may include many Linux distributions and other platforms that had not yet migrated to SDL3 (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit or active in-the-wild exploitation has been observed as of the time of reporting. The CVSS v4.0 exploit maturity is rated as "Proof of Concept," though no specific PoC has been publicly released. The EPSS score is approximately 0.083%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify targets running FreeRDP client versions prior to 3.23.0 built with SDL2 support, using network scanning or social engineering to direct victims to connect to an attacker-controlled RDP server.
2. Set up malicious RDP server: Configure a rogue RDP server capable of sending crafted pointer update PDUs (e.g., using tools like rdpy or a custom RDP server implementation).
3. Trigger pointer update: When the FreeRDP client connects, send a malformed or specially crafted pointer update that causes freerdp_image_copy_from_pointer_data() to fail within sdl_Pointer_New() in the SDL2 code path.
4. Trigger use-after-free: The failure path calls winpr_aligned_free(ptr->data) but does not null the pointer; subsequent access to ptr->data dereferences freed memory, causing a heap-use-after-free crash and denial of service of the client session (GitHub Advisory, Fix Commit SDL2).

• Process: Unexpected crash or segmentation fault of the FreeRDP client process (xfreerdp, sdl-freerdp, or similar), particularly during or shortly after RDP session establishment.
• Logs: Application crash logs or core dumps referencing sdl_Pointer_New, sdl_pointer.cpp, or heap corruption errors in FreeRDP client logs.
• Network: FreeRDP client connections to unknown or untrusted RDP servers (non-standard IPs/ports); repeated connection attempts followed by abrupt disconnections.
• File System: Presence of core dump files (e.g., core, core.<pid>) in the working directory of the FreeRDP process, potentially containing heap memory artifacts.

Upgrade FreeRDP to version 3.23.0 or later, which contains the complete fix for both SDL2 and SDL3 code paths (patch commits 5f62aa1 and c42ecbd) (GitHub Advisory). As a temporary workaround if patching is not immediately possible, restrict network access to RDP ports (default TCP 3389) to trusted sources only, and avoid connecting to untrusted or unknown RDP servers. Ubuntu and SUSE have released updated packages addressing this vulnerability (Linux Security Ubuntu, Linux Security SUSE).

The vulnerability was reported by security researcher ori-ron who identified the incomplete fix while reviewing the prior advisory for CVE-2026-24680 (GitHub Advisory). The FreeRDP maintainer akallabeth acknowledged the report and promptly issued the corrective patch in version 3.23.0. The issue was noted in community Linux distribution update digests, including Solus and TUXEDO OS weekly updates, reflecting routine downstream patching activity with no significant alarm raised given the DoS-only impact.