CVE Intelligence
Analysis AI-assisted

CVE-2026-25952: FreeRDP use-after-free in xf_SetWindowMinMaxInfo (CWE-416)

FreeRDP versions before 3.23.0 contain a use-after-free (CWE-416) in xf_SetWindowMinMaxInfo, caused by a race between window deletion and the RAIL channel thread. NVD scores the issue 9.8 (CVSS 3.1, critical), and the record states that version 3.23.0 fixes it. No confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

FreeRDP is a free implementation of the Remote Desktop Protocol. According to the record, the function xf_SetWindowMinMaxInfo dereferences a window pointer that may already have been freed. The pointer comes from a hash table of RAIL windows without protection, and the main thread can delete the window while the RAIL channel thread is still using it. The issue is classified as CWE-416 (Use After Free).

Impact

  • A use-after-free can corrupt memory or crash the affected process. The record does not describe the exact outcome in a given deployment.
  • NVD rates the vulnerability 9.8 under CVSS 3.1 with network attack vector, low complexity, no privileges and no user interaction, with high confidentiality, integrity and availability impact.
  • The GitHub CNA rates it 5.5 under CVSS 4.0.

Affected products and versions

  • The record lists the product as FreeRDP (Freerdp Freerdp) and marks versions before 3.23.0 as affected.
  • The patched version is 3.23.0.
  • The patch files are in the client/X11 directory, which suggests the X11 client code path is involved. This is an inference from the referenced files.

Exploitation status

The CISA KEV catalog does not list this CVE in the record, so no active exploitation is reported by KEV. The SSVC field in the record reports exploitation as poc, which indicates a proof-of-concept status, but this does not confirm exploitation in the wild. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00687 (percentile 0.52161).

Remediation and mitigation

  • Upgrade FreeRDP to version 3.23.0 or later, as stated in the record and the GitHub Security Advisory.
  • Review the upstream fix commit if you maintain a custom build or a downstream package.
  • Until patching is possible, limit exposure of systems running affected FreeRDP clients and restrict which hosts can reach them, based on your own risk assessment.

Detection guidance

  • Inventory all systems that ship or run FreeRDP, including embedded and packaged builds, and record their versions.
  • Monitor for unexpected crashes or abnormal terminations of FreeRDP client processes, which may indicate memory corruption.
  • Track window-related session activity in environments where RAIL is used, and review logs for anomalies around session teardown.

Limitations of the available information

  • The record does not list all affected versions before 3.23.0 beyond the upper bound, and it does not list distributions or packages that carry the fix.
  • The record does not describe the preconditions an attacker needs beyond the CVSS vector and the race condition.
  • The record does not confirm whether non-X11 builds are affected.
  • No public exploit details are included here, and no confirmed exploitation was found in the sources consulted.

Frequently asked questions

Which FreeRDP versions are affected by CVE-2026-25952?

According to the record, FreeRDP versions before 3.23.0 are affected. Version 3.23.0 contains the fix. The record does not list every earlier version individually.

Is this vulnerability being actively exploited?

The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The SSVC field reports a poc status, which is not the same as confirmed exploitation.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.