CVE Intelligence
Analysis AI-assisted

CVE-2026-25959: FreeRDP heap use-after-free in clipboard handler xf_cliprdr_provide_data_

CVE-2026-25959 is a heap use-after-free in FreeRDP's X11 clipboard redirection code, where freed clipboard data can be passed to XChangeProperty after a race between the cliprdr channel thread and the X11 event thread. The record assigns a critical NVD score of 9.8 and lists version 3.23.0 as the fix. No confirmed active exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-25959 affects FreeRDP, a free implementation of the Remote Desktop Protocol. According to the record, the X11 clipboard code in xf_cliprdr_provide_data_ can pass a data pointer that was already freed to XChangeProperty. The record describes a race between the clipboard channel thread and the X11 event thread, which leads to a heap use-after-free (CWE-416). The vendor advisory and the fixing commit are listed in the record.

Impact

  • The NVD base score is 9.8 (critical), with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes network attack vector, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability.
  • The GitHub-provided score in the record is 5.5. The two scores differ, and the record does not explain the difference.
  • A use-after-free can corrupt memory or crash the process. The record does not confirm which of these outcomes is achievable in practice.

Affected products and versions

  • Product: FreeRDP (Freerdp Freerdp in the CVE data).
  • The record states that versions before 3.23.0 are affected.
  • Fixed version: 3.23.0.
  • The record does not state whether older branches received backported fixes, and it does not list every affected build or distribution package.

Exploitation status

The CISA KEV catalog does not list this CVE according to the record. No confirmed exploitation in the wild appears in the sources consulted. The record includes an SSVC exploitation value of "poc" and an EPSS probability of 0.01008 (percentile 0.62738). These values are risk-prioritization signals, not reports of attacks. The GitHub advisory reference carries an "Exploit" tag, but the record does not describe what that tag refers to.

Remediation and mitigation

  • Upgrade FreeRDP to version 3.23.0 or later, as stated by the record.
  • Check whether your distribution or vendor packages a FreeRDP client build based on a version before 3.23.0, and update those packages through your normal patch process.
  • Review the vendor advisory GHSA-78xg-v4p2-4w3c and the linked commit to confirm the scope of the fix.
  • Where updating is not immediately possible, consider limiting clipboard redirection in RDP client sessions as a temporary measure. The record does not provide a validated workaround, so treat this as an operational choice to be tested first.

Detection guidance

  • Inventory FreeRDP client installations on Linux and X11-based systems, including bundled copies in other applications, and record their versions.
  • Watch for unexpected crashes or abnormal terminations of FreeRDP client processes during sessions that use clipboard redirection, as these may indicate memory corruption. Crashes alone do not prove exploitation.
  • Correlate endpoint and session logs with RDP connections from untrusted networks.

Limitations of the available information

  • The record does not state a proof-of-concept URL, a confirmed exploit, or any exploitation report.
  • The record does not confirm the exact conditions needed for the race to be triggered, and it does not confirm the practical impact on any particular platform.
  • The reason for the difference between the NVD score (9.8) and the GitHub score (5.5) is not stated.
  • Information about backports to older release lines is not available in the record.

Frequently asked questions

Which FreeRDP versions are affected by CVE-2026-25959?

According to the record, versions before 3.23.0 are affected. Version 3.23.0 contains the fix. The record does not list every affected build or distribution package.

Is CVE-2026-25959 being actively exploited?

The record does not list the CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted. The SSVC value and EPSS score are prioritization signals, not reports of attacks.

What should administrators do first?

Identify FreeRDP client installations, including bundled copies, and update them to version 3.23.0 or later. Where updating is delayed, consider limiting clipboard redirection as a temporary measure after testing it.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.