CVE-2026-29774: 
NixOS vulnerability analysis and mitigation

CVE-2026-29774 is a client-side heap buffer overflow vulnerability in FreeRDP's AVC420/AVC444 YUV-to-RGB conversion path, caused by missing horizontal bounds validation of H.264 metablock regionRects coordinates. It affects all FreeRDP versions up to and including 3.23.0, and was disclosed on March 13, 2026, with a fix released in version 3.24.0. The vulnerability carries a CVSS v3.1 base score of 8.2 (High) per Feedly threat intelligence data, though the official GitHub advisory rates it as Moderate (5.3) (GitHub Advisory, Red Hat).

The root cause (CWE-787: Out-of-bounds Write) lies in yuv.c, where the clamp() function (line 347) validates only the top/bottom coordinates against the surface height but never checks left/right against the surface width. When avc420_yuv_to_rgb (line 67) computes destination pointers using pDstPoint = pDstData + rect->top * nDstStep + rect->left * 4, the unchecked rect->left value allows pointer arithmetic to reach far beyond the allocated surface buffer. A malicious RDP server can exploit this by sending a WIRE_TO_SURFACE_PDU_1 PDU with AVC420 codec containing a regionRects entry where left=60000 on a 128px-wide surface, causing 16-byte SSE vector writes 1888+ bytes past the allocated heap region. The fix (commit 6482b7a) adds isRectValid() and areRectsValid() functions that validate all four rectangle coordinates against both surface width and height before processing (GitHub Advisory, GitHub Commit).

A malicious RDP server can trigger a client-side heap buffer overflow, causing a crash (denial of service) and heap corruption in the FreeRDP client process. Because the attacker controls the write offset via the left coordinate, there is potential for arbitrary writes to adjacent heap objects, which could enable remote code execution depending on heap allocator layout. No confidentiality impact is expected in a crash scenario, but integrity and availability of the client process are directly affected, and code execution risk elevates the severity for environments connecting to untrusted RDP servers (GitHub Advisory).

A concrete proof-of-concept exploit sequence is publicly documented in the official GitHub security advisory, describing a deterministic series of RDPGFX PDU messages a malicious server can send to trigger the overflow without requiring custom code compilation (GitHub Advisory). No user interaction is required — the vulnerability is triggered automatically when a FreeRDP client connects to a malicious server. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.039% (0.000390), indicating low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog.

1. Set up a malicious RDP server: Configure a server capable of sending crafted RDPGFX PDUs over a Dynamic Virtual Channel (DVC), targeting a FreeRDP client that supports AVC420/H.264 graphics.
2. Initiate RDP connection: Wait for or socially engineer a FreeRDP client to connect to the malicious server (no authentication bypass required — the server controls the graphics channel after connection).
3. Send CAPS_CONFIRM: Transmit a CAPS_CONFIRM PDU with CAPVERSION_81 and AVC420_ENABLED flag to negotiate AVC420 codec support with the client.
4. Create a small surface: Send a CREATE_SURFACE PDU creating a 128×128 pixel surface with XRGB_8888 format, followed by MAP_SURFACE_TO_OUTPUT to bind it.
5. Start a graphics frame: Send a START_FRAME PDU to begin a graphics update sequence.
6. Send malicious WIRE_TO_SURFACE_PDU_1: Transmit a WIRE_TO_SURFACE_PDU_1 with AVC420 codec containing a regionRects entry with RDPGFX_ALIGNED_RECT16(left=60000, top=0, right=60016, bottom=16) — the left coordinate far exceeds the 128px surface width.
7. Trigger heap overflow: The H.264 bitstream decodes successfully; yuv420_process_work_callback calls avc420_yuv_to_rgb, which computes pDstPoint = pDstData + 0 * nDstStep + 60000 * 4, writing 16-byte SSE vectors 1888+ bytes past the allocated heap region, causing a crash or heap corruption.
8. Send END_FRAME: Complete the frame sequence; the overflow has already occurred in the worker thread (GitHub Advisory).

• Network: FreeRDP client connections to unexpected or untrusted RDP servers; RDPGFX PDUs over DVC containing WIRE_TO_SURFACE_PDU_1 with AVC420 codec and anomalously large left coordinate values (e.g., >surface width) in regionRects.
• Process: Unexpected crash or abort of the FreeRDP client process (xfreerdp, wfreerdp, etc.); AddressSanitizer reports of heap-buffer-overflow in avc420_yuv_to_rgb or sse41_YUV420ToRGB; child processes spawned by the FreeRDP process unexpectedly.
• Logs: Application crash logs referencing libfreerdp/codec/yuv.c, libfreerdp/primitives/sse/prim_YUV_sse4.1.c, or STORE_SI128; core dumps from the FreeRDP client process; system logs showing abnormal termination of RDP client sessions.
• File System: Unexpected core dump files in the working directory of the FreeRDP client process (GitHub Advisory).

Upgrade FreeRDP to version 3.24.0 or later, which includes the fix (commit 6482b7a) adding proper bounds validation for all regionRects coordinates before processing (GitHub Commit, GitHub Advisory). Until patching is possible, avoid connecting FreeRDP clients to untrusted or unknown RDP servers, and consider network segmentation to restrict RDP connections to trusted sources only. Linux distribution users should apply vendor-provided package updates (e.g., Fedora, openSUSE, Amazon Linux 2, Debian) as they become available (Red Hat).

Red Hat tracked the vulnerability via Bugzilla (Bug 2447382) and published a CVE advisory shortly after disclosure (Red Hat, Red Hat Bugzilla). Multiple Linux distributions including Fedora, openSUSE, Amazon Linux 2, and Debian issued security updates addressing this and related FreeRDP vulnerabilities. Tenable and Qualys both released detection plugins for the vulnerability. The reporter credited is ehdgks0627 (GitHub Advisory).