CVE-2026-29776: 
NixOS vulnerability analysis and mitigation

CVE-2026-29776 is an integer underflow vulnerability in FreeRDP's core library, specifically in the update_read_cache_bitmap_order() function located in libfreerdp/core/orders.c. A UINT16 value read from the network is stored in a UINT32 field (bitmapLength), and when 8 is subsequently subtracted without a bounds check, the result can wrap around to a very large value (e.g., 0xFFFFFFFF), potentially causing a program crash or denial of service. All FreeRDP versions prior to 3.24.0 are affected. It was disclosed on March 13, 2026, with a CVSS v3.1 base score of 3.1 (Low) (FreeRDP Advisory, Red Hat).

The root cause is an integer underflow (CWE-191) in update_read_cache_bitmap_order(): bitmapLength is declared as UINT32 in CACHE_BITMAP_ORDER but populated from a 2-byte (UINT16) wire value. When the compressed bitmap path is taken and the NO_BITMAP_COMPRESSION_HDR flag is absent, 8 bytes are read from the stream and then subtracted from bitmapLength without first verifying that bitmapLength >= 8. If the server sends a bitmapLength of 0–7, the subtraction wraps to values like 0xFFFFFFFF (4,294,967,295). The only guard (if (bitmapLength == 0) goto fail) is bypassed by the wrapped value, leading to a malloc() call with an enormous size and a subsequent Stream_Read() of up to ~4 GB, which causes a reliable denial of service. The fix (commit a9e0abf) adds a pre-subtraction check: if (cache_bitmap->bitmapLength < 8) goto fail; (FreeRDP Advisory, Fix Commit). The vulnerability is also associated with CWE-190 (Integer Overflow or Wraparound), CWE-400 (Uncontrolled Resource Consumption), and CWE-789 (Memory Allocation with Excessive Size Value).

Successful exploitation results in a denial of service condition — the FreeRDP client process crashes or becomes unresponsive due to an attempted ~4 GB memory allocation and heap over-read. There is no impact to confidentiality or data integrity; only availability is affected. The attack requires the victim to connect to a malicious or compromised RDP server, limiting the blast radius to individual client sessions rather than enabling lateral movement or data exfiltration (FreeRDP Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires high attack complexity (a malicious or compromised RDP server) and user interaction (the victim must initiate an RDP connection), significantly limiting exploitability. The EPSS score is approximately 0.033%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (FreeRDP Advisory, Red Hat).

1. Set up a malicious RDP server: An attacker operates or compromises an RDP server capable of sending crafted RDP protocol messages to connecting clients.
2. Lure the victim to connect: The attacker tricks a user running a vulnerable FreeRDP client (version ≤ 3.23.0) into connecting to the malicious server, e.g., via phishing or a rogue network.
3. Send a crafted Cache Bitmap Order: During the RDP session, the server sends a Secondary Drawing Order of type Cache Bitmap with the compressed flag set and NO_BITMAP_COMPRESSION_HDR not set, with bitmapLength set to a value between 0 and 7 (e.g., 7).
4. Trigger the integer underflow: The client reads bitmapLength as a UINT16 into a UINT32 field, then subtracts 8 without a bounds check, wrapping the value to 0xFFFFFFF9 (4,294,967,289).
5. Cause denial of service: The client attempts malloc(0xFFFFFFF9) and, if successful (e.g., on a 64-bit Linux system with memory overcommit), proceeds to Stream_Read() of ~4 GB, triggering an out-of-memory condition or OOM kill, crashing the FreeRDP process (FreeRDP Advisory).

• Process: Unexpected termination or crash of the xfreerdp or wfreerdp process, particularly after connecting to an external or unfamiliar RDP server.
• Logs: System OOM killer logs (dmesg or /var/log/syslog) showing the FreeRDP process killed due to memory exhaustion; entries such as Out of memory: Kill process [pid] (xfreerdp).
• Network: RDP connections (TCP port 3389) to unfamiliar or external server IPs initiated by end-user workstations, followed by abrupt session termination.
• File System: Core dump files (e.g., core, xfreerdp.core) generated in the working directory or configured core dump path after a FreeRDP crash (FreeRDP Advisory).

Update FreeRDP to version 3.24.0 or later, which includes the fix introduced in commit a9e0abf that adds a pre-subtraction bounds check in update_read_cache_bitmap_order(). As a workaround for systems that cannot be updated immediately, restrict users from connecting to untrusted or external RDP servers, and enforce network-level controls (e.g., firewall rules) to limit outbound RDP connections to known, trusted servers. Downstream distributions including Fedora, openSUSE, SUSE, Amazon Linux 2, and Debian have released updated packages (Red Hat Bugzilla, Fix Commit).

The vulnerability was reported by security researcher rahulhoysala and disclosed via the FreeRDP GitHub Security Advisory on March 13, 2026. Red Hat tracked the issue as low severity (Bug 2447381), consistent with the upstream CVSS score. Multiple Linux distributions (Fedora, openSUSE/SUSE, Amazon Linux 2, Debian) issued security updates, and scanner vendors Tenable (Nessus) and Qualys added detection plugins shortly after disclosure. No significant broader media coverage or notable social media discussion has been observed beyond routine vulnerability tracking (FreeRDP Advisory, Red Hat Bugzilla).