CVE-2026-33987: 
NixOS vulnerability analysis and mitigation

CVE-2026-33987 is a heap-based buffer overflow vulnerability in FreeRDP's persistent cache handling, dubbed "Persistent Cache bmpSize Desync - Heap OOB Write." It affects all FreeRDP versions prior to 3.24.2 and was disclosed on March 25–30, 2026, with a patch released in version 3.24.2. The flaw carries a CVSS v3.1 base score of 7.1 (High) per the GitHub Security Advisory, or 6.6 (Medium) per NVD scoring (GitHub Advisory, Feedly).

The root cause is an incorrect ordering of operations in persistent_cache_read_entry_v3() within libfreerdp/cache/persistent.c (CWE-122: Heap-based Buffer Overflow; CWE-131: Incorrect Calculation of Buffer Size). Specifically, persistent->bmpSize is updated before the call to winpr_aligned_recalloc(); if the reallocation fails, bmpSize is inflated while bmpData still points to the old, undersized buffer. On the next cache entry with a size smaller than the inflated bmpSize, the realloc is skipped, and fread writes entry data — potentially up to 4 MB — into a buffer as small as 16 KB, causing an out-of-bounds heap write. Exploitation requires a crafted .bmc persistent cache file and local access. The fix moves the bmpSize update to after a successful realloc (GitHub Advisory, Patch Commit).

Successful exploitation can result in arbitrary code execution, heap memory corruption, or denial of service. The vulnerability has high integrity and availability impact with no confidentiality impact, as the overflow can corrupt heap structures or crash the FreeRDP client process. Because exploitation requires local access and user interaction (opening a malicious .bmc cache file), the blast radius is limited to the affected client system and does not directly enable lateral movement or remote compromise (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access, low privileges, and user interaction — specifically, the victim must open a crafted .bmc persistent cache file (GitHub Advisory).

1. Craft a malicious .bmc cache file: Create a specially crafted FreeRDP persistent bitmap cache file (.bmc) containing a sequence of entries designed to trigger a reallocation failure followed by an undersized buffer write — e.g., an initial large entry that causes bmpSize inflation, followed by a smaller entry that bypasses the realloc check.
2. Deliver the file to the target: Place the malicious .bmc file in the FreeRDP persistent cache directory (typically ~/.freerdp/cache/ on Linux) via social engineering, a shared filesystem, or another local access vector.
3. Trigger cache loading: Cause the victim to launch FreeRDP with persistent cache enabled, which will invoke persistent_cache_read_entry_v3() and process the malicious cache file.
4. Trigger the heap OOB write: The inflated bmpSize causes the realloc to be skipped on the second entry; fread then writes up to 4 MB of attacker-controlled data into the undersized heap buffer, potentially overwriting adjacent heap metadata or objects.
5. Achieve code execution or crash: Depending on heap layout and allocator behavior, the overflow may enable arbitrary code execution under the FreeRDP process's privileges or cause a denial of service (GitHub Advisory, Patch Commit).

• File System: Unexpected or modified .bmc files in the FreeRDP persistent cache directory (e.g., ~/.freerdp/cache/*.bmc on Linux or %APPDATA%\freerdp\cache\ on Windows) with anomalous sizes or timestamps.
• Process: FreeRDP client process (xfreerdp, wfreerdp) crashing unexpectedly or producing ASAN/heap corruption error messages referencing persistent_cache_read_entry_v3 or libfreerdp/cache/persistent.c.
• Logs: Application crash logs or core dumps associated with the FreeRDP process; system logs showing segmentation faults or heap corruption signals (SIGSEGV, SIGABRT) from the FreeRDP binary.

Update FreeRDP to version 3.24.2 or later, which contains the fix moving bmpSize update to after a successful realloc (GitHub Advisory, Patch Commit). Downstream distributions including Red Hat, Rocky Linux, Amazon Linux 2023, openSUSE, Debian, and Fedora have issued updated packages (Red Hat Errata, Amazon Linux). As a temporary workaround for systems that cannot be updated immediately, disable FreeRDP's persistent cache feature (/persistent-cache:off), restrict access to the cache directory, and apply the principle of least privilege to limit local user interaction with RDP cache data (Feedly).

The vulnerability was credited to Calvin Young of eWalker Consulting (HK) Limited and Enoch Chow of Isomorph Cyber, and was published by FreeRDP maintainer akallabeth via GitHub Security Advisories (GitHub Advisory). Multiple Linux distribution security teams (Red Hat, Fedora, openSUSE, Debian, Amazon Linux) issued advisories and updated packages in the weeks following disclosure. Coverage appeared on pro-linux.de and linuxcompatible.org, reflecting routine community tracking of the patch rollout across distributions (Feedly).