CVE-2026-40254: 
NixOS vulnerability analysis and mitigation

CVE-2026-40254 is a path traversal vulnerability in FreeRDP caused by an off-by-one error in the contains_dotdot() function within channels/drive/client/drive_file.c. It affects all FreeRDP versions up to and including 3.24.2, and was patched in version 3.25.0. The vulnerability was published on April 24, 2026, and allows a rogue RDP server to read, list, or write files one directory above the client's shared folder when drive redirection is enabled. The CVSS v3.1 base score is 6.1 (Medium) per NVD, while the GitHub advisory rates it 4.2 (Moderate) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an off-by-one error (CWE-193) in the contains_dotdot() function that results in a path traversal weakness (CWE-22). Specifically, at line 111 of drive_file.c, the condition if (tst + 2 < path + path_length) uses a strict less-than comparison, which evaluates to false when a path ends with .. (e.g., /shared/..) because tst + 2 equals path + path_length exactly. The function correctly blocks mid-path traversal sequences like ../ or ..\ but fails to detect .. as the terminal path component with no trailing separator. A rogue RDP server can exploit this by issuing RDPDR I/O requests (open, list, read, write) using paths ending in .., escaping the shared drive root by one directory level. Exploitation requires the victim to have connected with drive redirection enabled (e.g., xfreerdp /v:evil.server /drive:work,/home/user/documents) (GitHub Advisory).

A rogue RDP server can read, list, or write files in the directory immediately above the client's shared folder through RDPDR requests, resulting in limited but unauthorized information disclosure and file modification. The confidentiality and integrity impacts are low — an attacker can access one directory level above the shared root, not arbitrary filesystem locations. Availability is not impacted. The scope is changed in the NVD scoring, reflecting that the vulnerable client component affects resources outside its immediate security boundary (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept C program is included in the GitHub security advisory, demonstrating that /shared/.. bypasses the contains_dotdot() filter while /shared/../secret is correctly blocked. The PoC confirms the bug exists but does not provide a full end-to-end exploit against a live FreeRDP server. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Set up a rogue RDP server: The attacker configures a malicious RDP server (e.g., using a custom RDP server implementation) that can issue arbitrary RDPDR (Remote Desktop Protocol Device Redirection) I/O requests to connected clients.
2. Lure the victim to connect: The attacker social-engineers the victim into connecting to the rogue server with drive redirection enabled, for example: xfreerdp /v:evil.server /drive:work,/home/user/documents.
3. Issue a crafted RDPDR request: The rogue server sends an RDPDR file open/list/read/write request using a path ending in .. without a trailing separator (e.g., /work/..), which bypasses the contains_dotdot() filter due to the off-by-one error.
4. Access files above the shared root: The client processes the request as valid, allowing the attacker to read, list, or write files in the parent directory of the shared folder (e.g., /home/user/ instead of /home/user/documents) (GitHub Advisory).

• Network: Outbound RDP connections (TCP port 3389) to unknown or untrusted servers with drive redirection negotiated in the RDP handshake; RDPDR channel traffic containing path components ending in .. without a trailing separator.
• Logs: FreeRDP client logs showing RDPDR I/O requests to paths like /sharename/..; unexpected file access events in the parent directory of the configured shared folder.
• File System: Unexpected file modifications or new files appearing in the directory one level above the RDP-shared folder (e.g., if /home/user/documents is shared, watch for changes in /home/user/).
• Process: xfreerdp or other FreeRDP client processes connected to unfamiliar RDP server addresses with /drive: arguments in the command line (GitHub Advisory).

Upgrade FreeRDP to version 3.25.0 or later, which fixes the off-by-one error by adding an end-of-string check before inspecting the character following ... As a workaround for systems that cannot be immediately patched, disable drive redirection in RDP client configurations unless strictly necessary. Additionally, restrict RDP connections to trusted, verified servers and monitor RDPDR activity for suspicious file access patterns targeting parent directories of shared folders (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported by a researcher credited as "Medoedus" and published by FreeRDP maintainer akallabeth via GitHub's security advisory system. Red Hat tracked the issue via Bugzilla and the Red Hat CVE advisory page. Coverage appeared in Linux-focused outlets including Pro-Linux.de and LinuxCompatible, and the fix was included in downstream distributions such as Fedora, Amazon Linux 2023, and Debian 13.5. The WebProNews article on FreeRDP 3.25 highlighted the release's security fixes alongside new features like AV1 video and FIDO2 redirection (GitHub Advisory, Red Hat CVE).