CVE-2026-33983: 
NixOS vulnerability analysis and mitigation

CVE-2026-33983 is a Denial of Service vulnerability in FreeRDP's progressive codec implementation, specifically in the progressive_decompress_tile_upgrade() function. It affects all FreeRDP versions prior to 3.24.2 and was published on March 30, 2026, with the fix released in version 3.24.2. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium), requiring network access and user interaction to exploit (GitHub Advisory, Red Hat CVE).

The root cause is an integer underflow/wraparound (CWE-190) combined with an unchecked return value (CWE-252) in progressive_rfx_quant_sub(). When progressive_decompress_tile_upgrade() detects a quantization mismatch via progressive_rfx_quant_cmp_equal(), it only emits a WLog_WARN warning and continues execution rather than aborting. The resulting wrapped byte value (247) is then used as a shift exponent, triggering undefined behavior (confirmed by UBSan with 7 distinct "shift exponent too large" violations per tile) and causing an approximately 80 billion iteration loop that exhausts CPU resources. The fix modifies progressive_rfx_quant_sub() to return a BOOL and adds underflow checks for each quantization component, causing progressive_decompress_tile_upgrade() to fail gracefully on invalid values (GitHub Advisory, Fix Commit).

Successful exploitation causes a complete CPU hang on the affected FreeRDP client, rendering the remote desktop session unresponsive and unusable. There is no memory corruption, and no confidentiality or integrity impact — the vulnerability is limited to availability (DoS). An attacker controlling a malicious RDP server could serve crafted progressive codec data to any connecting client, causing it to hang indefinitely until the process is killed (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.042%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a victim must connect to a malicious RDP server — which somewhat limits the attack surface (GitHub Advisory, Red Hat CVE).

1. Set up a malicious RDP server: An attacker configures a rogue RDP server capable of serving crafted progressive codec (RFX) tile data with mismatched quantization values between passes.
2. Lure the victim: The attacker tricks a user running a vulnerable FreeRDP client (version ≤ 3.24.1) into connecting to the malicious server, e.g., via a phishing link or social engineering.
3. Serve malicious progressive codec data: Upon connection, the server sends RDP graphics data using the progressive codec with quantization values that trigger a mismatch in progressive_rfx_quant_cmp_equal(), causing progressive_rfx_quant_sub() to produce an underflowed byte value (247).
4. Trigger CPU DoS: The wrapped value (247) is used as a shift exponent in the codec processing loop, causing undefined behavior and an approximately 80 billion iteration loop that fully saturates the victim's CPU, hanging the FreeRDP client process (GitHub Advisory).

• Process: FreeRDP client process (xfreerdp, wfreerdp, or similar) consuming 100% CPU for an extended period without user activity.
• Logs: UBSan runtime errors referencing "shift exponent too large" in FreeRDP debug output if compiled with sanitizers enabled.
• Network: Outbound RDP connections (TCP port 3389 or custom RDP port) to unfamiliar or suspicious server IP addresses, particularly if the connection precedes a CPU spike.
• System: System-level CPU utilization alerts or watchdog triggers caused by a single FreeRDP process monopolizing CPU resources.

The primary remediation is to upgrade FreeRDP to version 3.24.2 or later, which contains the fix in commit 78188ab (Fix Commit). Red Hat has issued patches for RHEL 8, 9, and 10 via multiple errata (RHSA-2026:8457, RHSA-2026:8458, RHSA-2026:8945, and others) (Red Hat Bugzilla). Amazon Linux 2 and 2023 updates are also available. As a workaround where patching is not immediately possible, restrict FreeRDP client connections to trusted RDP servers only and implement network-level controls to block connections to untrusted RDP endpoints.

The vulnerability was discovered and reported by Calvin Young of eWalker Consulting (HK) Limited and Enoch Chow of Isomorph Cyber, and was disclosed responsibly through GitHub's security advisory process (GitHub Advisory). Red Hat rated the issue as high severity and promptly issued patches across multiple RHEL versions. Coverage has appeared in Linux security news outlets and German Linux security publication Pro-Linux, reflecting broad awareness in the open-source community.