CVE-2026-29775: 
NixOS vulnerability analysis and mitigation

CVE-2026-29775 is a heap-based buffer overflow (off-by-one) vulnerability in FreeRDP's bitmap cache subsystem, specifically in the bitmap_cache_put function. A malicious RDP server can send a CACHE_BITMAP_ORDER (Rev1) with a cacheId equal to maxCells, bypassing the boundary guard and accessing one element past the allocated cells[] array. All FreeRDP versions prior to 3.24.0 are affected. The vulnerability was disclosed on March 13, 2026, and carries a CVSS v3.1 base score of 8.2 (High) per Feedly/Red Hat, though the GitHub advisory rates it 5.3 (Moderate) (GitHub Advisory, Red Hat CVE).

The root cause is an off-by-one boundary check in bitmap_cache_put (libfreerdp/cache/bitmap.c:246), classified as CWE-787 (Out-of-bounds Write). The function uses a strict greater-than check (id > bitmapCache->maxCells) instead of the correct greater-than-or-equal check used by bitmap_cache_get (id >= bitmapCache->maxCells). With the default BitmapCacheV2NumCells = 5, the cells array is allocated as cells[0..4] (80 bytes via calloc); when a server sends cacheId = 5, the guard passes and the code first performs an OOB READ of 4 bytes at cells[5].number (line 254), then potentially an OOB WRITE of a pointer at cells[5].entries[index] (line 262). The Rev1 order parses cacheId as a full UINT8 (values 0–255), making this attack path accessible, whereas the Rev2 variant masks cacheId to 2 bits and is not exploitable this way (GitHub Advisory, Fix Commit).

Successful exploitation allows a malicious RDP server to cause a client-side heap out-of-bounds read/write, resulting in a crash (denial of service) and heap corruption. Depending on heap layout, the pointer overwrite at cells[maxCells].entries[index] could potentially be leveraged for arbitrary code execution on the connecting client. Confidentiality impact is assessed as none, while integrity is low and availability is high, as the most reliable outcome is a client crash (GitHub Advisory, Red Hat CVE).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, describing a deterministic attack sequence where a malicious RDP server sends a FastPath update with a secondary CACHE_BITMAP_ORDER (Rev1) using cacheId = 5 to trigger the out-of-bounds access. The exploit requires no authentication and no user interaction beyond the client connecting to the malicious server. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.039% (GitHub Advisory).

1. Set up a malicious RDP server: Configure a server capable of sending crafted RDP protocol messages, including FastPath updates with secondary bitmap cache orders.
2. Lure the victim client: Trick a FreeRDP client (version ≤ 3.23.0) into connecting to the malicious server, optionally using social engineering or a man-in-the-middle position.
3. Complete capability negotiation: Optionally include a proper Demand Active PDU with bitmap cache capability advertisement; alternatively, the client can be launched with /relax-order-checks /cache:bitmap flags to bypass capability checks in a PoC scenario.
4. Send the malicious CACHE_BITMAP_ORDER: Transmit a FastPath update containing a secondary CACHE_BITMAP_ORDER (Rev1, ORDER_TYPE_BITMAP_UNCOMPRESSED) with cacheId = 5 (equal to maxCells), cacheIndex = 0, and a minimal valid bitmap payload (e.g., 4×4 uncompressed 8bpp, 16 bytes).
5. Trigger OOB access: The client processes the order via update_gdi_cache_bitmap → bitmap_cache_put, which passes the off-by-one guard and reads 4 bytes from cells[5].number (0 bytes past the 80-byte allocation), then writes a pointer to cells[5].entries[0].
6. Achieve DoS or heap corruption: The OOB access causes an immediate crash (DoS); with heap layout manipulation, the pointer overwrite may enable further exploitation such as code execution on the client (GitHub Advisory).

• Process: FreeRDP client process (xfreerdp, wfreerdp, etc.) crashing unexpectedly or with AddressSanitizer errors referencing bitmap_cache_put in libfreerdp/cache/bitmap.c.
• Logs: Application crash logs or core dumps showing stack traces through bitmap_cache_put → update_gdi_cache_bitmap → update_recv_secondary_order → fastpath_recv_orders; error messages such as put invalid bitmap cell id: 5.
• Network: Unexpected or unsolicited RDP server connections; FastPath update PDUs containing secondary bitmap cache orders with cacheId values equal to or exceeding the negotiated BitmapCacheV2NumCells (typically 5).
• File System: Core dump files generated by the FreeRDP client process in the working directory or system crash directory following an RDP session.

The vulnerability is fixed in FreeRDP version 3.24.0, where the fix over-allocates the bitmap cache by one element (calloc(BitmapCacheV2NumCells + 1, sizeof(BITMAP_V2_CELL))) to safely handle the off-by-one access (Fix Commit). Red Hat has issued multiple errata addressing this issue across RHEL 7 through 10 (RHSA-2026:16014, 16019, 16482, 16483, 16485, 16777, 16814, 16865, 16866, 19142, 19358, 19811, 20546, 20605) (Red Hat Bugzilla). Until patching is possible, restrict FreeRDP client connections to trusted RDP servers only, disable RDP client usage if not required, and avoid connecting to untrusted or unknown RDP servers.

The vulnerability was reported by security researcher ehdgks0627 and published by the FreeRDP maintainer akallabeth via GitHub Security Advisory on March 13, 2026 (GitHub Advisory). Multiple Linux distributions including Red Hat, SUSE, openSUSE, Debian, AlmaLinux, Rocky Linux, and Amazon Linux 2 issued security advisories and updated packages. The vulnerability received broad coverage in Linux security news outlets and was tracked by Nessus and Qualys scanners shortly after disclosure.