CVE Intelligence
Analysis AI-assisted

CVE-2026-25955: FreeRDP heap use-after-free in xf_AppUpdateWindowFromSurface via stale XImage

FreeRDP versions before 3.23.0 contain a use-after-free (CWE-416) in xf_AppUpdateWindowFromSurface, where a cached XImage can point to a surface buffer that was already freed. The record states that version 3.23.0 fixes the issue, and NVD assigns a critical CVSS base score of 9.8. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-25955 affects FreeRDP, a free implementation of the Remote Desktop Protocol. According to the record, the X11 client function xf_AppUpdateWindowFromSurface can reuse a cached XImage whose data pointer refers to a surface buffer that has already been freed. This is a use-after-free condition classified as CWE-416.

Impact

  • NVD assigns a CVSS base score of 9.8 (critical), with network attack vector, low complexity, no privileges and no user interaction required.
  • The vector in the record indicates high impact on confidentiality, integrity and availability under NVD's scoring. The actual impact in a given deployment is unknown.
  • GitHub, as CNA, lists a separate CVSS score of 5.5 for the same issue.

Affected products and versions

  • Product: FreeRDP (listed in the record as Freerdp Freerdp).
  • Affected: versions before 3.23.0.
  • Fixed in: 3.23.0, as stated in the description.

Exploitation status

This CVE is not listed in the CISA KEV catalog in the record, so no active exploitation is confirmed in the sources consulted. The SSVC data in the record marks exploitation as proof of concept (poc) and automatable as yes. EPSS estimates a probability of 0.00885, which is a statistical estimate and not evidence of attacks.

Remediation and mitigation

  • Update FreeRDP to 3.23.0 or a later release that includes the fix.
  • Review the GitHub security advisory and the fix commit to confirm which code paths were changed.
  • Until patching is complete, prioritize systems that connect to untrusted or unmanaged RDP servers, since this reduces exposure (inference).

Detection guidance

  • Inventory FreeRDP client builds and packages on X11 systems and flag any version earlier than 3.23.0.
  • Monitor for unexpected crashes or terminations of FreeRDP client sessions. This is a general symptom to watch for, not a confirmed indicator of exploitation.

Limitations of the available information

  • The record does not provide detailed trigger conditions, and it lists no fixed versions other than 3.23.0.
  • Whether downstream distributions have backported the fix is unknown.
  • The record does not state whether non-X11 builds are affected, so this analysis is limited to the X11 client code referenced in the patches.
  • No confirmed exploitation is documented in the sources consulted.

Frequently asked questions

Which FreeRDP versions are affected by CVE-2026-25955?

According to the record, versions before 3.23.0 are affected.

Is this vulnerability known to be exploited in the wild?

No. The CVE is not listed in CISA KEV in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.