CVE-2026-25952

EUVD-2026-8732

25.02.2026, 21:16

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` in `xf_rail_server_min_max_info` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 36%

Affected Products (NVD)

Vendor	Product	Version
freerdp	freerdp	𝑥 < 3.23.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

freerdp2

bookworm	no-dsa
bullseye	vulnerable
bullseye (security)	vulnerable

freerdp3

forky	3.26.0+dfsg-1 fixed
sid	3.26.0+dfsg-1 fixed
trixie	3.15.0+dfsg-2.1+deb13u3 fixed

openSUSE / SLES Releases

openSUSE Product

Release

freerdp

suse enterprise desktop 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise sap 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise server 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise workstation 15 SP7	3.10.3-150700.3.14.1 fixed

freerdp-devel

suse enterprise desktop 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise sap 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise server 12 SP5	2.1.2-12.68.1 fixed
suse enterprise server 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise workstation 15 SP7	3.10.3-150700.3.14.1 fixed

freerdp-proxy

suse enterprise desktop 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise sap 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise server 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise workstation 15 SP7	3.10.3-150700.3.14.1 fixed

freerdp-proxy-plugins

suse enterprise desktop 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise sap 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise server 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise workstation 15 SP7	3.10.3-150700.3.14.1 fixed

freerdp-sdl

suse enterprise desktop 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise sap 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise server 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise workstation 15 SP7	3.10.3-150700.3.14.1 fixed

freerdp-server

suse enterprise desktop 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise sap 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise server 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise workstation 15 SP7	3.10.3-150700.3.14.1 fixed

freerdp2

suse enterprise desktop 15 SP7	2.11.7-150700.3.22.1 fixed
suse enterprise sap 15 SP7	2.11.7-150700.3.22.1 fixed
suse enterprise server 15 SP7	2.11.7-150700.3.22.1 fixed
suse enterprise workstation 15 SP7	2.11.7-150700.3.22.1 fixed

freerdp2-devel

suse enterprise desktop 15 SP7	2.11.7-150700.3.22.1 fixed
suse enterprise sap 15 SP7	2.11.7-150700.3.22.1 fixed
suse enterprise server 15 SP7	2.11.7-150700.3.22.1 fixed
suse enterprise workstation 15 SP7	2.11.7-150700.3.22.1 fixed

freerdp2-proxy

suse enterprise desktop 15 SP7	2.11.7-150700.3.22.1 fixed
suse enterprise sap 15 SP7	2.11.7-150700.3.22.1 fixed
suse enterprise server 15 SP7	2.11.7-150700.3.22.1 fixed
suse enterprise workstation 15 SP7	2.11.7-150700.3.22.1 fixed

freerdp2-server

suse enterprise desktop 15 SP7	2.11.7-150700.3.22.1 fixed
suse enterprise sap 15 SP7	2.11.7-150700.3.22.1 fixed
suse enterprise server 15 SP7	2.11.7-150700.3.22.1 fixed
suse enterprise workstation 15 SP7	2.11.7-150700.3.22.1 fixed

libfreerdp-server-proxy3-3

suse enterprise desktop 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise sap 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise server 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise workstation 15 SP7	3.10.3-150700.3.14.1 fixed

libfreerdp2-2

suse enterprise desktop 15 SP7	2.11.7-150700.3.22.1 fixed
suse enterprise sap 15 SP7	2.11.7-150700.3.22.1 fixed
suse enterprise server 15 SP7	2.11.7-150700.3.22.1 fixed
suse enterprise workstation 15 SP7	2.11.7-150700.3.22.1 fixed

libfreerdp3-3

suse enterprise desktop 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise sap 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise server 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise workstation 15 SP7	3.10.3-150700.3.14.1 fixed

librdtk0-0

suse enterprise desktop 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise sap 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise server 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise workstation 15 SP7	3.10.3-150700.3.14.1 fixed

libwinpr2-2

suse enterprise desktop 15 SP7	2.11.7-150700.3.22.1 fixed
suse enterprise sap 15 SP7	2.11.7-150700.3.22.1 fixed
suse enterprise server 15 SP7	2.11.7-150700.3.22.1 fixed
suse enterprise workstation 15 SP7	2.11.7-150700.3.22.1 fixed

libwinpr3-3

suse enterprise desktop 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise sap 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise server 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise workstation 15 SP7	3.10.3-150700.3.14.1 fixed

winpr-devel

suse enterprise desktop 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise sap 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise server 15 SP7	3.10.3-150700.3.14.1 fixed
suse enterprise workstation 15 SP7	3.10.3-150700.3.14.1 fixed

winpr2-devel

suse enterprise desktop 15 SP7	2.11.7-150700.3.22.1 fixed
suse enterprise sap 15 SP7	2.11.7-150700.3.22.1 fixed
suse enterprise server 12 SP5	2.1.2-12.68.1 fixed
suse enterprise server 15 SP7	2.11.7-150700.3.22.1 fixed
suse enterprise workstation 15 SP7	2.11.7-150700.3.22.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

freerdp

RHEL 8	2:2.11.7-9.el8_10 fixed
RHEL 8.4 AUS	2:2.2.0-14.el8_4 fixed
RHEL 8.6 AUS	2:2.2.0-7.el8_6.8 fixed
RHEL 8.6 E4S	2:2.2.0-7.el8_6.8 fixed
RHEL 8.6 TUS	2:2.2.0-7.el8_6.8 fixed
RHEL 8.8 E4S	2:2.2.0-12.el8_8.8 fixed
RHEL 8.8 TUS	2:2.2.0-12.el8_8.8 fixed
RHEL 9	2:2.11.7-7.el9_8.3 fixed

freerdp-devel

RHEL 8	2:2.11.7-9.el8_10 fixed
RHEL 9	2:2.11.7-7.el9_8.3 fixed

freerdp-libs

RHEL 8	2:2.11.7-9.el8_10 fixed
RHEL 8.4 AUS	2:2.2.0-14.el8_4 fixed
RHEL 8.6 AUS	2:2.2.0-7.el8_6.8 fixed
RHEL 8.6 E4S	2:2.2.0-7.el8_6.8 fixed
RHEL 8.6 TUS	2:2.2.0-7.el8_6.8 fixed
RHEL 8.8 E4S	2:2.2.0-12.el8_8.8 fixed
RHEL 8.8 TUS	2:2.2.0-12.el8_8.8 fixed
RHEL 9	2:2.11.7-7.el9_8.3 fixed

libwinpr

RHEL 8	2:2.11.7-9.el8_10 fixed
RHEL 8.4 AUS	2:2.2.0-14.el8_4 fixed
RHEL 8.6 AUS	2:2.2.0-7.el8_6.8 fixed
RHEL 8.6 E4S	2:2.2.0-7.el8_6.8 fixed
RHEL 8.6 TUS	2:2.2.0-7.el8_6.8 fixed
RHEL 8.8 E4S	2:2.2.0-12.el8_8.8 fixed
RHEL 8.8 TUS	2:2.2.0-12.el8_8.8 fixed
RHEL 9	2:2.11.7-7.el9_8.3 fixed

libwinpr-devel

RHEL 8	2:2.11.7-9.el8_10 fixed
RHEL 8.4 AUS	2:2.2.0-14.el8_4 fixed
RHEL 8.6 AUS	2:2.2.0-7.el8_6.8 fixed
RHEL 8.6 E4S	2:2.2.0-7.el8_6.8 fixed
RHEL 8.6 TUS	2:2.2.0-7.el8_6.8 fixed
RHEL 8.8 E4S	2:2.2.0-12.el8_8.8 fixed
RHEL 8.8 TUS	2:2.2.0-12.el8_8.8 fixed
RHEL 9	2:2.11.7-7.el9_8.3 fixed

Known Exploits!

Common Weakness Enumeration

CWE-416 - Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

References

https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1167

https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1174

https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1178

https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1230-L1238

https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L643

https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1111

https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1128

https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1394

https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1428

https://github.com/FreeRDP/FreeRDP/commit/1994e9844212a6dfe0ff12309fef520e888986b5

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cgqm-cwjg-7w9x