CVE-2026-33986: 
NixOS vulnerability analysis and mitigation

CVE-2026-33986 is a heap-based buffer overflow vulnerability in FreeRDP's H.264 codec processing, dubbed "H.264 YUV Buffer Dimension Desync - Heap OOB Write." It affects all FreeRDP versions prior to 3.24.2 and was discovered by Calvin Young of eWalker Consulting (HK) Limited and Enoch Chow of Isomorph Cyber. The advisory was published on March 25, 2026, with the CVE assigned on March 30, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat).

The root cause is an incorrect ordering of dimension updates relative to buffer reallocation in yuv_ensure_buffer() within libfreerdp/codec/h264.c (CWE-122: Heap-based Buffer Overflow; CWE-131: Incorrect Calculation of Buffer Size). Specifically, h264->width and h264->height are updated at lines 86–87 before the reallocation loop (lines 89–100); if any winpr_aligned_recalloc() call fails, the function returns FALSE but the stored dimensions are already inflated. On the next call with the same dimensions, the condition (width != h264->width || height != h264->height) evaluates to FALSE, causing the reallocation to be skipped entirely — the H.264 decoder then writes decoded YUV data into the original, undersized buffers. ASAN confirmed a heap-buffer-overflow WRITE of up to 33,685,504 bytes (33 MB) into a 2,048-byte buffer, with partially attacker-controlled content via crafted H.264 NAL units delivered over RDPGFX AVC420 frames from a malicious RDP server (GitHub Advisory, Patch Commit).

Successful exploitation can result in high-severity impacts across confidentiality, integrity, and availability: sensitive heap memory adjacent to the undersized YUV buffers may be disclosed, heap metadata and other data structures can be corrupted (potentially enabling arbitrary code execution), and the affected FreeRDP client process may crash causing denial of service. The attack is network-accessible and targets FreeRDP clients connecting to a malicious RDP server, meaning any user connecting to an untrusted RDP endpoint is at risk. The massive scale of the overflow (up to 33 MB with partially attacker-controlled content) makes this the most severe finding in the associated advisory (GitHub Advisory, Red Hat Bugzilla).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.039% (0.000390), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, a user must connect to a malicious RDP server — and the attack complexity is rated High, as the attacker must control or impersonate an RDP server and trigger a specific allocation failure sequence (GitHub Advisory).

1. Set up a malicious RDP server: The attacker configures a rogue RDP server capable of serving crafted RDPGFX AVC420 (H.264) frames, using tools or custom code that can manipulate H.264 NAL unit content.
2. Lure the victim: The attacker entices a target user running a vulnerable FreeRDP client (version ≤ 3.24.1) to connect to the malicious RDP server, e.g., via phishing, a malicious link, or a compromised RDP gateway.
3. Trigger allocation failure: The malicious server sends an H.264-encoded frame that causes winpr_aligned_recalloc() to fail during the yuv_ensure_buffer() reallocation loop, leaving h264->width and h264->height inflated while the underlying buffers remain undersized.
4. Exploit dimension desync: On the next frame with the same (inflated) dimensions, the size check passes and reallocation is skipped. The H.264 decoder writes decoded YUV data — partially controlled via crafted NAL units — into the undersized buffer, causing a massive heap overflow.
5. Achieve objective: Depending on heap layout and attacker control over the overflow content, the attacker may achieve arbitrary code execution on the client system, leak sensitive heap data, or crash the FreeRDP process (GitHub Advisory, Patch Commit).

• Network: Unexpected or unsolicited RDP connection attempts to unknown or untrusted RDP servers; RDPGFX traffic containing anomalous AVC420 (H.264) frame sequences with unusual dimension changes.
• Process: FreeRDP client process crashing unexpectedly or producing ASAN/heap corruption error messages; abnormal child processes spawned from the FreeRDP client process.
• Logs: Application crash logs or core dumps referencing yuv_ensure_buffer() or h264.c; system logs showing repeated FreeRDP process restarts or segmentation faults during RDP sessions.
• File System: Unexpected core dump files (e.g., core.*) in the working directory of the FreeRDP process following an RDP session to an untrusted server.

Upgrade FreeRDP to version 3.24.2 or later, which defers h264->width and h264->height updates until after all buffer reallocations succeed (Patch Commit, GitHub Advisory). For systems where immediate patching is not possible, restrict FreeRDP client connections to trusted, verified RDP servers only, and disable RDP client usage if not required. Apply the principle of least privilege to accounts running FreeRDP to limit the impact of any successful exploitation. Linux distribution packages (Fedora, Amazon Linux 2/2023, openSUSE, Debian) have also released updated packages incorporating this fix (Amazon Linux AL2023, openSUSE).

The vulnerability was reported by security researchers Calvin Young (eWalker Consulting) and Enoch Chow (Isomorph Cyber), and the FreeRDP maintainer (akallabeth) published the advisory and patch promptly (GitHub Advisory). The issue received coverage from security aggregators including VulDB, INCIBE-CERT, and Pro-Linux, as well as automated posts on Mastodon and Bluesky from CVE tracking accounts. Red Hat, Amazon Linux, openSUSE, and Debian all issued advisories or updated packages, reflecting broad downstream attention from Linux distribution maintainers.