CVE-2026-85090: 
NixOS vulnerability analysis and mitigation

CVE-2026-85090 is a heap out-of-bounds read vulnerability in FreeRDP's general_ChromaV1ToYUV444 function, triggered during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFX_AVC444_BITMAP_STREAM with specific frame geometry to cause the FreeRDP client to read memory past the end of the allocated luma plane buffer. All FreeRDP versions from 3.0.0 up to and including 3.30.0 are affected; version 3.31.0 contains the fix. The vulnerability was published on September 3, 2026, and carries a CVSS v3.1 base score of 5.4 (Medium) (FreeRDP Advisory, Red Hat CVE).

The root cause (CWE-125: Out-of-bounds Read) lies in general_ChromaV1ToYUV444 within libfreerdp/primitives/prim_YUV.c. The function computes a 16-aligned padded height (padHeigth = nHeight + 16 - nHeight % 16) and iterates the source row index up to this padded value, but the bounds check (pos >= nHeight) only guards the destination write — the source memcpy from pSrc[0] + y * srcStep[0] executes unconditionally. When nHeight is already a multiple of 16, padHeigth becomes nHeight + 16, causing up to 16 extra source rows to be read past the tight luma plane allocation produced by yuv_ensure_buffer. The same flaw is duplicated in the NEON (prim_YUV_neon.c) and SSE4.1 (prim_YUV_sse4.1.c) implementations. Exploitation requires network access and user interaction (the victim must connect to a malicious RDP server), with no authentication required on the server side (FreeRDP Advisory, Fix Commit).

Successful exploitation leaks heap memory contents into the rendered chroma output — whatever data resides after the luma plane allocation (potentially sensitive process memory) becomes visible as color artifacts in the client's display, constituting a low-severity confidentiality breach. If the over-read crosses a page boundary, the FreeRDP client process crashes, resulting in a denial of service. The attacker controls the frame geometry and region rectangle, allowing them to choose where the over-read begins and its extent (up to ~15 rows × stride bytes). The impact is limited to the client-side FreeRDP process; there is no known path to code execution or lateral movement from this vulnerability alone (FreeRDP Advisory).

A public proof-of-concept (PoC) harness (chroma_v1_oob_read.c) is available in the FreeRDP security advisory, along with a Dockerfile that builds FreeRDP with AddressSanitizer and reproduces the ASan-detected heap-buffer-overflow. The PoC calls the primitives API directly with a tight luma plane and a crafted 64×64 frame, triggering the OOB read without requiring an H.264 decoder. As of the time of publication, there is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.003 (0.3%), reflecting low near-term exploitation probability (FreeRDP Advisory, Feedly).

1. Set up a malicious RDP server: Deploy a custom or modified RDP server capable of sending crafted RFX_AVC444_BITMAP_STREAM messages (e.g., using FreeRDP's server-side API or a modified open-source RDP server implementation).
2. Craft the frame geometry: Construct a frame whose height is a multiple of 16 (e.g., 64 pixels) and set the region rectangle so that roi->bottom == frameHeight. This ensures nHeight % 16 == 0, making padHeigth = nHeight + 16 and maximizing the over-read.
3. Send the crafted AVC444 stream: Transmit the malicious RFX_AVC444_BITMAP_STREAM to the connecting FreeRDP client during an active RDP session using AVC444 (H.264 444) encoding.
4. Trigger the OOB read: The client's general_ChromaV1ToYUV444 (or its NEON/SSE counterpart) iterates y up to padHeigth, reading source rows past the end of the tight luma plane allocation.
5. Observe the outcome: Heap bytes adjacent to the luma plane appear as chroma color artifacts in the rendered frame (memory disclosure), or the client crashes if the read crosses a page boundary (DoS) (FreeRDP Advisory).

• Network: FreeRDP client connections to unexpected or untrusted RDP server endpoints; RDP sessions using AVC444 (H.264 444-mode) encoding from servers not under organizational control.
• Process: Unexpected crash or segmentation fault of the FreeRDP client process (xfreerdp, wlfreerdp, sdl-freerdp, or embedded FreeRDP clients); ASan reports referencing neon_ChromaV1ToYUV444, general_ChromaV1ToYUV444, or sse41_ChromaV1ToYUV444 in stack traces.
• Logs: Core dump files generated by the FreeRDP client process; application logs showing heap-buffer-overflow or READ of size N at addresses immediately following a luma plane allocation.
• Visual: Anomalous color artifacts or corruption in RDP session display output, particularly at the bottom edge of frames with heights that are multiples of 16 (FreeRDP Advisory).

Upgrade FreeRDP to version 3.31.0 or later, which contains the fix (commit d0a481c) that adds a y < nHeight guard before the memcpy in all three affected implementations (generic, NEON, SSE4.1). As a workaround where immediate upgrade is not possible, restrict FreeRDP client connections to trusted, organizationally controlled RDP servers only, and disable AVC444/H.264 encoding if the RDP server configuration permits. Network segmentation limiting client exposure to untrusted RDP endpoints also reduces risk (FreeRDP Release, Fix Commit).

The FreeRDP maintainer (akallabeth) published the security advisory on August 31, 2026, and released the patched version 3.31.0 shortly after, explicitly urging distributors to update as soon as possible due to multiple severe issues addressed in the release. Red Hat tracked the vulnerability and assigned it a Moderate severity rating. No significant independent researcher commentary or broad social media discussion has been identified beyond standard vulnerability database aggregation (FreeRDP Release, Red Hat CVE).