CVE-2026-31897: 
NixOS vulnerability analysis and mitigation

CVE-2026-31897 is an out-of-bounds read vulnerability in FreeRDP's freerdp_bitmap_decompress_planar function, triggered when SrcSize is 0. It affects all FreeRDP versions prior to 3.24.0 (i.e., ≤ 3.23.0). The flaw was published on March 13, 2026, with a fix released in version 3.24.0. The CVSS v3.1 score assigned by Red Hat/Feedly is 9.1 (Critical), though the GitHub Security Advisory rates it Low (0.0) based on a more conservative assessment of real-world impact (GitHub Advisory, Red Hat CVE, Red Hat Bugzilla).

The root cause is a missing bounds check (CWE-125: Out-of-bounds Read) in libfreerdp/codec/planar.c at line 753. The function freerdp_bitmap_decompress_planar() dereferences *srcp (pointing to pSrcData) to read the FormatHeader byte unconditionally, without first verifying that SrcSize >= 1. When SrcSize is 0 and pSrcData is non-NULL, this reads one byte past the end of the source buffer. The exploitable protocol path is via RDPGFX: a malicious RDP server can send a Surface Command PDU with length = 0 and a valid non-NULL data pointer, triggering the OOB read through the call chain gdi_SurfaceCommand() → gdi_SurfaceCommand_Planar() → freerdp_bitmap_decompress_planar(). The fix adds an early check if (!pSrcData || (SrcSize < 1)) before the dereference (GitHub Advisory, Fix Commit).

Successful exploitation can result in two outcomes: disclosure of 1 byte of heap memory adjacent to the source buffer (information disclosure), or a crash of the FreeRDP client process when the OOB read hits an unmapped memory page (denial of service). Because FreeRDP is a client-side RDP implementation, a malicious or compromised RDP server is required to trigger the vulnerability against connecting clients. The integrity impact is none, and lateral movement potential is limited, but heap memory disclosure could theoretically leak sensitive data in memory-adjacent regions (GitHub Advisory, Red Hat CVE).

A public proof-of-concept (PoC) exploit is available in the GitHub Security Advisory, consisting of a complete standalone C program that calls freerdp_bitmap_decompress_planar() with SrcSize=0 and includes compilation instructions using AddressSanitizer (GitHub Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is 0.029% (very low probability of exploitation in the next 30 days), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE).

1. Set up a malicious RDP server: Deploy a rogue or compromised RDP server (e.g., using a modified FreeRDP server build or a custom RDP server implementation) that can send crafted RDPGFX Surface Command PDUs.
2. Lure a victim client to connect: Social-engineer or redirect a target FreeRDP client (version ≤ 3.23.0) to connect to the malicious server, for example via a crafted .rdp file or a phishing link.
3. Send a malformed Surface Command PDU: Once the client connects, transmit an RDPGFX Surface Command with cmd->length = 0 and a valid non-NULL data pointer. This triggers the call chain gdi_SurfaceCommand() → gdi_SurfaceCommand_Planar() → freerdp_bitmap_decompress_planar() with SrcSize=0.
4. Trigger OOB read: The function reads FormatHeader = *srcp++ at planar.c:753 without checking SrcSize >= 1, reading 1 byte past the end of the source buffer.
5. Achieve impact: Depending on memory layout, the attacker either receives 1 byte of heap memory (information disclosure) or causes the FreeRDP client to crash (denial of service) if the read hits an unmapped page (GitHub Advisory).

• Network: Unexpected or unsolicited RDP connections from unknown servers; RDPGFX Surface Command PDUs with a length field of 0 in network captures.
• Process: FreeRDP client process crashing unexpectedly (segmentation fault or abort) during an active RDP session, particularly when connecting to untrusted servers.
• Logs: Application crash logs or core dumps referencing freerdp_bitmap_decompress_planar in the stack trace; AddressSanitizer output showing heap-buffer-overflow at libfreerdp/codec/planar.c:753 in debug builds.
• File System: Unexpected core dump files (e.g., core.*) generated by the FreeRDP client process in the working directory (GitHub Advisory).

Upgrade FreeRDP to version 3.24.0 or later, which includes the fix adding an early bounds check (if (!pSrcData || (SrcSize < 1))) in libfreerdp/codec/planar.c before the dereference (Fix Commit, GitHub Advisory). As a workaround, restrict FreeRDP client connections to trusted, known-good RDP servers only, and avoid connecting to untrusted or unknown RDP endpoints. Linux distribution users should apply vendor-provided package updates (e.g., Fedora, SUSE, Debian, Amazon Linux 2 have all issued updated packages) (Red Hat Bugzilla).

The vulnerability was reported by researcher YJK0805 and published by the FreeRDP maintainer akallabeth via GitHub Security Advisories on March 13, 2026 (GitHub Advisory). Red Hat tracked it as a low-severity issue in their Bugzilla system, and multiple Linux distributions (Fedora, SUSE, Debian, Amazon Linux 2) issued security updates shortly after disclosure. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability tracking feeds.