CVE-2026-33982: 
NixOS vulnerability analysis and mitigation

CVE-2026-33982 is a heap-buffer-overflow out-of-bounds read vulnerability in FreeRDP's persistent cache allocator, specifically in the winpr_aligned_offset_recalloc() function. It affects all FreeRDP versions prior to 3.24.2 and was disclosed on March 25–30, 2026, with a patch released in version 3.24.2. The vulnerability was discovered by Calvin Young of eWalker Consulting (HK) Limited and Enoch Chow of Isomorph Cyber. It carries a CVSS v3.1 base score of 7.1 (High) per the GitHub advisory (local attack vector), while NVD scores it 8.1 (High) using a network attack vector (GitHub Advisory, Feedly).

The root cause is an allocator mismatch (CWE-125: Out-of-bounds Read) in libfreerdp/cache/persistent.c. In persistent_cache_new() (line 353), bmpData is allocated using the standard calloc(1, 0x4000). When persistent_cache_read_entry_v3() later calls winpr_aligned_recalloc() on this pointer, the aligned allocator attempts to read a WINPR_ALIGNED_MEM signature struct located 24 bytes before the buffer — reading into heap metadata that was never part of the aligned allocation. This mismatch triggers on any v3 persistent cache file containing an entry larger than 64×64 pixels at 32bpp, which is an extremely common scenario. Without ASAN, the signature check fails and winpr_aligned_free() is called on the calloc-allocated pointer, constituting undefined behavior (mismatched free); ASAN confirms the heap-buffer-overflow READ at 24 bytes before the allocation (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to read 24 bytes of heap metadata before the allocated buffer, resulting in high confidentiality impact through unauthorized memory disclosure. The mismatched free also introduces undefined behavior that can lead to application crashes or memory corruption, resulting in high availability impact (denial of service). Integrity is not directly affected. Exploitation requires user interaction — specifically, a user must open or connect using a maliciously crafted v3 persistent RDP cache file (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. Exploitation requires user interaction (opening a crafted persistent cache file), which further limits opportunistic exploitation.

1. Craft a malicious v3 persistent RDP cache file: Create a cache file containing at least one bitmap entry larger than 64×64 pixels at 32bpp, which triggers the code path in persistent_cache_read_entry_v3().
2. Deliver the cache file to the target: Social-engineer the victim into placing the malicious cache file in the FreeRDP persistent cache directory (e.g., ~/.freerdp/cache/ on Linux), or deliver it via a shared drive, phishing, or other means.
3. Trigger the vulnerable code path: When the victim launches FreeRDP and connects to an RDP server (or the cache is loaded automatically), persistent_cache_new() allocates bmpData with calloc, and persistent_cache_read_entry_v3() calls winpr_aligned_recalloc() on the non-aligned pointer.
4. Heap OOB read occurs: The aligned allocator reads 24 bytes before the calloc allocation, accessing heap metadata. This leaks memory contents and/or triggers undefined behavior via mismatched free.
5. Achieve objective: Depending on heap layout, the attacker may obtain sensitive heap metadata (memory disclosure) or cause a crash (denial of service) (GitHub Advisory, Patch Commit).

• File System: Unexpected or externally supplied files in the FreeRDP persistent cache directory (e.g., ~/.freerdp/cache/ on Linux or %APPDATA%\freerdp\cache\ on Windows) with unusually large bitmap entries or anomalous file sizes.
• Logs: Application crash logs or core dumps from the FreeRDP process (xfreerdp, wfreerdp) referencing persistent_cache_read_entry_v3 or winpr_aligned_recalloc in stack traces.
• Process: FreeRDP process terminating unexpectedly (segmentation fault or abort) shortly after loading a persistent cache file, particularly when ASAN or memory sanitizers are enabled reporting heap-buffer-overflow READ at -24 bytes offset.

Upgrade FreeRDP to version 3.24.2 or later, which replaces the mismatched calloc(1, 0x4000) call in persistent_cache_new() with winpr_aligned_calloc(1, 0x4000, 32), ensuring consistent use of the aligned allocator family throughout the persistent cache code (Patch Commit). As a workaround, users can disable the FreeRDP persistent bitmap cache feature (e.g., by not using the /persistent-cache option or removing existing cache files) to prevent the vulnerable code path from being triggered. Downstream distributions including Red Hat, Amazon Linux 2023, openSUSE, Debian, Rocky Linux, and Oracle Linux have issued updated packages (Red Hat Advisory, Amazon Linux).

The vulnerability was reported by security researchers Calvin Young (eWalker Consulting) and Enoch Chow (Isomorph Cyber), and the FreeRDP maintainer akallabeth published the advisory and patch promptly on March 25, 2026 (GitHub Advisory). Multiple Linux distributions (Red Hat, Debian, Amazon Linux, openSUSE, Rocky Linux, Oracle Linux) issued security updates, reflecting broad downstream attention. Coverage appeared on pro-linux.de and linuxcompatible.org, and Tenable published multiple Nessus detection plugins for the vulnerability (Feedly).