CVE-2026-27951: 
NixOS vulnerability analysis and mitigation

CVE-2026-27951 is an integer overflow vulnerability in FreeRDP's Stream_EnsureCapacity function that can trigger an endless blocking loop, resulting in a denial-of-service condition. It affects all FreeRDP client and server implementations prior to version 3.23.0. The vulnerability was disclosed on February 25, 2026, and was discovered by Ilja Van Sprundel of IOActive. It carries a CVSS v3.1 base score of 7.5 (High) per NVD, though the GitHub Security Advisory rates it as Moderate (5.3) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an integer overflow (CWE-190) in the Stream_EnsureCapacity function. When a stream is created with Stream_New(NULL, SSIZE_MAX/2), the function attempts to increase the allocation size by doubling new_capacity; this multiplication overflows SIZE_MAX, setting new_capacity to 0. Because the abort condition new_capacity >= size can never be satisfied when new_capacity remains 0, the function enters an infinite loop. Practical exploitation is constrained to 32-bit systems where available physical memory is greater than or equal to SIZE_MAX. The fix (commit 118afc0) replaces the doubling growth strategy with incremental additions of 128 elements and adds explicit overflow checks (GitHub Advisory, GitHub Commit).

Successful exploitation causes FreeRDP client and server processes to enter an endless blocking loop, rendering them completely unresponsive and unable to process legitimate RDP connections — a full availability denial-of-service. There is no confidentiality or integrity impact; the vulnerability cannot be used to access or modify data. Because the condition requires a 32-bit system with physical memory at or above SIZE_MAX, the practical attack surface is limited compared to a typical network-reachable DoS (GitHub Advisory, Red Hat Bugzilla).

The vulnerability is exploitable remotely without authentication or user interaction, as reflected in its network attack vector and no-privilege-required classification. A proof-of-concept trigger mechanism is publicly documented in the GitHub Security Advisory (creating a stream with Stream_New(NULL, SSIZE_MAX/2)), though no weaponized exploit kit or in-the-wild exploitation has been reported. The EPSS score is approximately 0.039%, indicating low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Red Hat Bugzilla).

1. Identify target: Locate a 32-bit system running FreeRDP (client or server) prior to version 3.23.0 with physical memory >= SIZE_MAX, reachable over the network.
2. Craft malicious stream request: Prepare a network payload that causes the FreeRDP peer to invoke Stream_EnsureCapacity with a size argument near or exceeding SSIZE_MAX/2 (e.g., by sending a specially crafted RDP PDU that triggers internal buffer growth).
3. Trigger integer overflow: The Stream_EnsureCapacity function doubles new_capacity starting from a value that, when doubled, overflows SIZE_MAX and wraps to 0.
4. Induce infinite loop: With new_capacity stuck at 0, the loop condition new_capacity >= size is never satisfied, causing the FreeRDP process to spin indefinitely and become unresponsive to all further connections (GitHub Advisory).

• Process: FreeRDP client or server process consuming 100% CPU on a 32-bit system with no corresponding legitimate workload; process becomes unresponsive and stops accepting new RDP connections.
• Logs: Absence of new RDP session log entries after a specific timestamp despite connection attempts; system logs may show the FreeRDP process as hung or unkillable without SIGKILL.
• Network: Sudden drop in RDP session establishment success rate from a specific source IP; connection timeouts to the FreeRDP service port (default TCP 3389 or configured RDP port) following an anomalous inbound connection.

Upgrade FreeRDP to version 3.23.0 or later, which contains the fix (commit 118afc0) replacing the doubling buffer growth with overflow-safe incremental allocation. Red Hat has issued multiple errata addressing this CVE across RHEL 7, 8, and 9 variants (RHSA-2026:16019, RHSA-2026:16482, RHSA-2026:16483, RHSA-2026:16485, RHSA-2026:16777, RHSA-2026:16814, RHSA-2026:16866, RHSA-2026:19358, RHSA-2026:19811, RHSA-2026:20546). No configuration-based workarounds are available; network-level access controls restricting RDP traffic to trusted sources can reduce exposure but do not eliminate the vulnerability (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was credited to Ilja Van Sprundel of IOActive, a well-known security research firm, lending credibility to the finding. Red Hat triaged it as medium severity and issued patches across numerous RHEL versions, indicating broad downstream impact for enterprise Linux users. Community coverage noted the constrained exploitation conditions (32-bit systems with large physical memory) as a significant mitigating factor limiting real-world risk (GitHub Advisory, Red Hat Bugzilla).