CVE-2026-33984: 
NixOS vulnerability analysis and mitigation

CVE-2026-33984 is a heap-based buffer overflow vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol, affecting all versions prior to 3.24.2. The flaw resides in the resize_vbar_entry() function within libfreerdp/codec/clear.c, where incorrect buffer size tracking can lead to attacker-controlled pixel data being written into an undersized heap buffer. It was published on March 30, 2026, and assigned a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause (CWE-122: Heap-based Buffer Overflow; CWE-131: Incorrect Calculation of Buffer Size) lies in a race condition between size tracking and memory allocation in resize_vbar_entry(). Specifically, vBarEntry->size is updated to vBarEntry->count before the winpr_aligned_recalloc() call at line 570 of clear.c. If realloc fails under memory pressure, size is inflated while pixels still points to the original, smaller buffer. On a subsequent call where count <= size (the now-inflated value), the reallocation is skipped entirely, and the caller writes count * bpp bytes of attacker-controlled pixel data into the undersized buffer — confirmed as a heap-buffer-overflow WRITE via ASAN. The fix (commit dc7fdb1) moves the size update to after a successful realloc (GitHub Advisory, Fix Commit). The attack vector is network-based, requires no privileges, but does require user interaction (connecting to a malicious RDP server).

Successful exploitation can result in high confidentiality, integrity, and availability impact on the affected FreeRDP client. A malicious RDP server can send specially crafted ClearCodec band data to trigger the overflow, potentially enabling arbitrary code execution in the context of the connecting user, reading sensitive memory contents, or crashing the FreeRDP client process. The overflow can write up to approximately 168 bytes beyond the allocated buffer, providing meaningful control over adjacent heap memory (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Red Hat CVE). The EPSS score is approximately 0.039%, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity — specifically, the attacker must control an RDP server that the victim connects to, and must be able to induce a memory allocation failure to trigger the inflated size condition.

1. Set up a malicious RDP server: The attacker configures a rogue RDP server (e.g., using a modified FreeRDP server or custom RDP implementation) capable of sending crafted ClearCodec band data.
2. Lure the victim to connect: The attacker tricks a user running a vulnerable FreeRDP client (version ≤ 3.24.1) into connecting to the malicious server, for example via phishing or a compromised RDP shortcut file.
3. Populate a vbar cache entry with a small buffer: The server sends ClearCodec data that causes resize_vbar_entry() to allocate a small pixel buffer for a specific vbar cache slot.
4. Trigger a failed realloc under memory pressure: The server sends a larger ClearCodec request for the same cache slot. The attacker arranges for winpr_aligned_recalloc() to fail (e.g., by exhausting heap memory), causing vBarEntry->size to be inflated to the new count value while pixels still points to the old, smaller buffer.
5. Exploit the inflated size on a subsequent call: The server reuses the same cache slot with a count value ≤ the inflated size. The realloc is skipped, and the caller writes count * bpp bytes of attacker-controlled pixel data into the undersized buffer, achieving a heap out-of-bounds write of up to ~168 bytes.
6. Achieve code execution or crash: Depending on heap layout, the overflow may corrupt adjacent heap metadata or function pointers, potentially enabling arbitrary code execution in the FreeRDP client process (GitHub Advisory).

• Network: Outbound RDP connections (TCP port 3389 or custom ports) from client systems to unknown or untrusted external IP addresses; unusual RDP session initiation to non-corporate servers.
• Process: FreeRDP client process (xfreerdp, wfreerdp) crashing unexpectedly or producing ASAN/heap corruption error output; abnormal child processes spawned from the FreeRDP process.
• Logs: Application crash logs or core dumps referencing resize_vbar_entry() or libfreerdp/codec/clear.c; system logs showing segmentation faults or heap corruption in FreeRDP processes.
• File System: Unexpected files written by the FreeRDP process user account following an RDP session to an untrusted server; new or modified files in user home directories post-session.

The vulnerability is patched in FreeRDP version 3.24.2; all users should upgrade immediately (GitHub Advisory). Red Hat has issued multiple errata addressing this issue across RHEL 8, 9, and 10 (RHSA-2026:8457, RHSA-2026:8458, RHSA-2026:8945, and others) (Red Hat Bugzilla). Amazon Linux 2 and 2023 updates are also available. As a workaround where patching is not immediately possible, restrict FreeRDP client connections to trusted RDP servers only, and block outbound RDP to untrusted external hosts at the network perimeter.

The vulnerability was credited to Calvin Young of eWalker Consulting (HK) Limited and Enoch Chow of Isomorph Cyber, and was published by the FreeRDP project maintainer akallabeth on March 25, 2026 (GitHub Advisory). Red Hat, Amazon Linux, AlmaLinux, Rocky Linux, Oracle Linux, openSUSE, and Debian all issued advisories and patches in the weeks following disclosure, indicating broad downstream attention. Social media mentions were observed on Mastodon and Bluesky, and security news aggregators covered the issue as part of broader FreeRDP vulnerability roundups.