CVE-2026-31806: 
NixOS vulnerability analysis and mitigation

CVE-2026-31806 is a heap-based buffer overflow vulnerability in FreeRDP's nsc_process_message() function, triggered by unvalidated bitmap dimensions in RDP SURFACE_BITS_COMMAND messages. It affects all FreeRDP versions prior to 3.24.0 and was disclosed on March 13, 2026, by researcher wooseokdotkim via the FreeRDP GitHub security advisory program. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, Red Hat CVE).

The root cause is an incorrect calculation of buffer size (CWE-131) and a resulting heap-based buffer overflow (CWE-122) in libfreerdp/codec/nsc.c. The gdi_surface_bits() function passes cmd->bmp.width and cmd->bmp.height from a server-controlled SURFACE_BITS_COMMAND message directly to nsc_process_message() without validating them against the negotiated desktop dimensions. The destination buffer (gdi->primary_buffer) is allocated based on the negotiated desktop size (e.g., 1024×768×4 bytes), but the internal bounds check only verifies nXDst < nWidth — it does not enforce nXDst + bmp_width ≤ nWidth or nYDst + bmp_height ≤ nHeight. A malicious RDP server can supply oversized dimensions (e.g., 4000×4000) along with crafted pixel data, causing a heap out-of-bounds write beyond the destination buffer. The fix in commit 83d9aed adds clamping logic to limit the copy area to the bounds of the destination buffer (GitHub Advisory, Fix Commit).

Successful exploitation allows an unauthenticated attacker operating a malicious RDP server to trigger a heap out-of-bounds write, potentially corrupting adjacent heap chunk metadata and achieving remote code execution (RCE) with the privileges of the FreeRDP client process. In release builds without memory sanitizers, the overflow may result in silent heap corruption without an immediate crash, making detection harder. The vulnerability affects confidentiality, integrity, and availability at the highest level, and could be leveraged for lateral movement if the compromised client has access to internal network resources (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept (PoC) exploit is publicly available in the FreeRDP GitHub security advisory, consisting of a complete, compilable C harness (harness.c) and a Dockerfile that demonstrates the heap buffer overflow by calling nsc_process_message() with attacker-controlled dimensions (4000×4000) against a 1024×768 desktop buffer. Feedly classifies this PoC as a real exploit with high confidence. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.042%, reflecting low but non-zero exploitation probability. No specific threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Set up a malicious RDP server: Deploy a custom or modified RDP server capable of sending crafted SURFACE_BITS_COMMAND messages with attacker-controlled bmp.width and bmp.height values (e.g., 4000×4000) that exceed the negotiated desktop resolution.
2. Lure or redirect a FreeRDP client: Trick a user running a vulnerable FreeRDP client (version ≤ 3.23.0) into connecting to the malicious server, for example via a phishing link, DNS poisoning, or a man-in-the-middle attack on an RDP connection.
3. Negotiate desktop dimensions: Complete the RDP handshake with a small desktop resolution (e.g., 1024×768) so the client allocates a correspondingly small primary_buffer (1024×768×4 = ~3 MB).
4. Send crafted SURFACE_BITS_COMMAND via NSCodec: Transmit a SURFACE_BITS_COMMAND message specifying bmp.width=4000 and bmp.height=4000 with NSCodec encoding, along with crafted pixel data designed to overwrite specific adjacent heap memory regions.
5. Trigger heap overflow: The client's gdi_surface_bits() passes the unvalidated dimensions to nsc_process_message(), which writes pixel data beyond the bounds of the destination buffer, corrupting adjacent heap metadata.
6. Achieve code execution: Leverage heap corruption techniques (e.g., overwriting function pointers or heap management structures) to redirect execution flow and execute arbitrary code with the privileges of the FreeRDP client process (GitHub Advisory).

• Network: Unexpected or unsolicited RDP connection attempts from unknown servers; RDP traffic containing SURFACE_BITS_COMMAND messages with bitmap dimensions significantly exceeding the negotiated desktop resolution.
• Process: FreeRDP client process (xfreerdp, wfreerdp) crashing unexpectedly or producing core dumps after connecting to an RDP server; unusual child processes spawned by the FreeRDP client.
• Logs: Application crash logs or core dumps referencing nsc_process_message() or gdi_surface_bits() in the stack trace; AddressSanitizer (ASAN) reports indicating heap-buffer-overflow in libfreerdp/codec/nsc.c.
• File System: Unexpected core dump files (e.g., /tmp/core.*) generated by the FreeRDP process; new or modified files in directories writable by the FreeRDP client user account following an RDP session.

The primary remediation is to upgrade FreeRDP to version 3.24.0 or later, which includes the fix in commit 83d9aed that clamps the copy area to the bounds of the destination buffer (Fix Commit). Red Hat has issued multiple errata addressing this vulnerability across RHEL 7 through 10, including RHSA-2026:6340 (RHEL 9), RHSA-2026:6918 (RHEL 8), RHSA-2026:6799 (RHEL 10), and others (Red Hat Bugzilla). As a workaround until patching is possible, restrict FreeRDP client connections to trusted, verified RDP servers only, and consider disabling NSCodec surface processing if the client configuration supports it. Downstream distributions including openSUSE, Fedora, AlmaLinux, Amazon Linux 2, Mageia, and Debian have also released updated packages.

The vulnerability was reported by researcher wooseokdotkim and published by FreeRDP maintainer akallabeth via GitHub's security advisory process on March 13, 2026 (GitHub Advisory). Red Hat rated the issue as High severity and tracked it through Bugzilla, issuing over a dozen errata across supported RHEL versions (Red Hat Bugzilla). The vulnerability received broad coverage across Linux distribution security channels including openSUSE, Fedora, AlmaLinux, Amazon Linux, and Debian, reflecting the wide deployment of FreeRDP across Linux environments.