CVE-2026-33985: 
NixOS vulnerability analysis and mitigation

CVE-2026-33985 is a heap out-of-bounds read vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol, specifically in the ClearCodec glyph cache handling. The flaw exists in versions up to and including 3.24.1, and was patched in version 3.24.2. It was disclosed on March 25, 2026, via a GitHub Security Advisory and published to NVD on March 30, 2026. The CVSS v3.1 base score is 5.9 (Medium) per the GitHub advisory, though some sources estimate it as high as 7.1 (GitHub Advisory, Red Hat Bugzilla).

The root cause is an incorrect calculation of buffer size (CWE-131) combined with an out-of-bounds read (CWE-125) in clear_decompress_glyph_data() within libfreerdp/codec/clear.c. Specifically, glyphEntry->count is set to nWidth * nHeight unconditionally before the winpr_aligned_recalloc() call; if the realloc fails, count is inflated while pixels still points to the original, smaller buffer. On a subsequent CLEARCODEC_FLAG_GLYPH_HIT call, the bounds check compares (nWidth * nHeight) > glyphEntry->count, which passes incorrectly due to the inflated count, allowing convert_color() to read up to 65,472 bytes beyond the allocated glyph buffer — a heap OOB read confirmed by ASAN. The fix defers the count update until after a successful realloc (GitHub Advisory, Fix Commit).

Successful exploitation causes pixel data from adjacent heap memory to be rendered to the client's screen, potentially exposing sensitive information such as credentials, encryption keys, or other confidential data residing in heap memory. The attack requires network access and user interaction (a user must connect to a malicious or compromised RDP server), but requires no privileges. There is no integrity impact; availability impact is low, and confidentiality impact is rated high, as up to 65,472 bytes of adjacent heap memory may be leaked per exploitation event (GitHub Advisory, Red Hat Bugzilla).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, a user must connect to a malicious RDP server — which limits opportunistic exploitation (GitHub Advisory).

1. Set up a malicious RDP server: An attacker configures a rogue RDP server capable of sending crafted ClearCodec-encoded glyph data to connecting clients.
2. Trigger CLEARCODEC_FLAG_GLYPH_INDEX: The attacker's server sends a ClearCodec stream with a CLEARCODEC_FLAG_GLYPH_INDEX message containing dimensions (nWidth, nHeight) that cause winpr_aligned_recalloc() to fail, leaving glyphEntry->count inflated relative to the actual buffer size.
3. Send CLEARCODEC_FLAG_GLYPH_HIT: The server subsequently sends a CLEARCODEC_FLAG_GLYPH_HIT referencing the same glyph cache entry. The inflated count causes the bounds check to pass, and convert_color() reads up to 65,472 bytes beyond the allocated buffer.
4. Capture leaked data: The out-of-bounds heap data is rendered to the client's screen as pixel data. The attacker, controlling the server, can observe or capture this rendered output to extract sensitive information from the client's heap memory.
5. Social engineering (if needed): The attacker may need to lure the victim into connecting to the malicious RDP server via phishing or other means, since user interaction is required (GitHub Advisory, Fix Commit).

• Network: Unexpected or unsolicited RDP connection attempts to unknown or untrusted servers; RDP traffic to external IPs not matching known corporate RDP infrastructure.
• Logs: FreeRDP client logs showing WLog_ERR messages related to glyphEntry->pixels winpr_aligned_recalloc failures or ClearCodec glyph processing errors; repeated RDP session initiations to the same suspicious host.
• Process: FreeRDP client process (xfreerdp, wfreerdp) connecting to non-standard or unexpected RDP endpoints; unusual memory usage spikes in the FreeRDP process during RDP sessions.

Upgrade FreeRDP to version 3.24.2 or later, which defers the glyphEntry->count update until after a successful realloc, eliminating the OOB read condition (Fix Commit). Red Hat has issued multiple errata addressing this issue across RHEL 7 through 10 (RHSA-2026:16014, 16019, 16482, 16483, 16485, 16777, 16814, 16866, 19358, 19811, 20546, 20605) (Red Hat Bugzilla). Amazon Linux 2 and AL2023 have also released advisories (ALAS2-2026-3238, ALAS2023-2026-1549), and openSUSE and Debian have issued updates as well. As a workaround where patching is not immediately possible, restrict RDP client connections to trusted servers only, implement network segmentation to limit RDP exposure, and enforce multi-factor authentication for RDP access.

The vulnerability was credited to Calvin Young of eWalker Consulting (HK) Limited and Enoch Chow of Isomorph Cyber, who reported it to the FreeRDP project (GitHub Advisory). Red Hat, Amazon Linux, openSUSE, Debian, and AlmaLinux all issued security advisories and patches in a timely manner following disclosure. The vulnerability received coverage from Linux security news outlets including pro-linux.de and linuxcompatible.org, and was tracked by Tenable Nessus with multiple detection plugins.