Freerdp CVE-2026-25953

CRITICAL

Use After Free (CWE-416)

2026-02-25 security-advisories@github.com

Use After Free Red Hat Freerdp Suse

Critical

Disputed · 9.8 NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Connect to malicious RDP server
Exploit

Server sends crafted fastpath window-delete order
Execution

RDPGFX DVC thread reads freed pointer
Impact

Execute arbitrary code with client privileges

Vulnerability Assessment

Weakness	CWE CWE-416 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Memory lifecycle management MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	FreeRDP versions prior to 3.23.0 with RDPGFX DVC (Dynamic Virtual Channel) support enabled connecting to an attacker-controlled RDP server. No authentication or user interaction required.
Impact	CVSS 9.8. Second FreeRDP UAF — malicious RDP server attack vector.
Exploit ScenarioDerived	RDP server sends surface updates that trigger UAF in the client's window management.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Mar 12, 2026

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corruption. PoC and patch available.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:55 CVSS 9.8

UAF in FreeRDP surface update handling.

RemediationAI

Update FreeRDP to 3.23.0.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

CWE-416 UAF in xf_AppUpdateWindowFromSurface. Surface update operations reference freed window objects.

Know when Freerdp gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)

GitHub Advisory PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE CRITICAL

Red Hat 4.3 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

3

PoC Detected

Feb 27, 2026 - 14:55 vuln.today

Public exploit code

Patch released

Feb 27, 2026 - 14:55 nvd

Patch available

CVE Published

Feb 25, 2026 - 21:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xf_AppUpdateWindowFromSurface reads from a freed xfAppWindow because the RDPGFX DVC thread obtains a bare pointer via xf_rail_get_window without any lifetime protection, while the main thread can concurrently delete the window through a fastpath window-delete order. Version 3.23.0 fixes the issue.

Executive ViewAI

Why It Matters

A critical remote code execution vulnerability (CVSS 9.8) in FreeRDP enables unauthenticated attackers to gain complete system control over affected endpoints. Any organization using FreeRDP for remote access-including employees, contractors, and third-party vendors-faces immediate risk of data breach, system compromise, and operational disruption if systems remain unpatched.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If patching cannot be completed immediately: (1) Restrict FreeRDP network access via firewall to authorized source IPs only; (2) Isolate FreeRDP systems to a separate network segment with limited lateral movement; (3) Disable FreeRDP service on systems where remote access is not actively required; (4) Implement enhanced logging and real-time monitoring for FreeRDP connection attempts; (5) Require VPN access before allowing any FreeRDP connections.

Threat Intelligence Overview

EPSS Score

0.1%

Top 75% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

CVE.org

EPSS Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

69

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Affected Products (CPE)GitHub Advisory

cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*

More in Freerdp

View all

CVE-2026-25997 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth

CVE-2026-25952 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor

CVE-2026-25959 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem

CVE-2026-22857 CRITICAL Act Now POC

FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi

CVE-2026-22854 CRITICAL Act Now POC

FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai

CVE-2026-22852 CRITICAL Act Now POC

FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m

CVE-2026-25955 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and

CVE-2024-32041 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-40574 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

CVE-2023-40569 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

CVE-2023-40567 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

CVE-2023-40187 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2014-0322 HIGH POC

CVE-2012-4792 HIGH POC

CVE-2009-4324 HIGH POC

CVE-2015-0313 CRITICAL POC

CVE-2015-5122 CRITICAL POC

CVE-2013-2551 HIGH POC

Same technique Use After Free

View all

CVE-2012-4969 HIGH POC

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed

References

Advisories & patches

PATCH https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1230-L1237 PATCH https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L257-L290 PATCH https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L643-L647 PATCH https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1394-L1428 PATCH https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1462-L1470 PATCH https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1484-L1491 PATCH https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/libfreerdp/gdi/gfx.c#L254-L286 PATCH https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/libfreerdp/gdi/gfx.c#L278-L279 PATCH https://github.com/FreeRDP/FreeRDP/commit/1994e9844212a6dfe0ff12309fef520e888986b5 ADVISORY https://vuldb.com/vuln/347867

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy