PT-2026-22011 · Freerdp+2 · Freerdp+2

Ehdgks0627 · Published 2026-01-01 · Updated 2026-05-22 · CVE-2026-25954

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0

Description FreeRDP is a free implementation of the Remote Desktop Protocol. A flaw exists in the RAIL channel window management where the xf rail server local move size function dereferences a freed xfAppWindow pointer. This occurs because the xf rail get window function returns an unprotected pointer from the railWindows hash table, and the main thread can delete the window while the RAIL channel thread is still using the pointer.

Recommendations Update to version 3.23.0 or later.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2026-04148

CVE-2026-25954

GHSA-CC88-4J37-MW6J

OESA-2026-2439

OESA-2026-2440

OESA-2026-2441

OESA-2026-2442

OPENSUSE-SU-2026:10408-1

OPENSUSE-SU-2026:10611-1

OPENSUSE-SU-2026:20632-1

OPENSUSE-SU-2026:20657-1

SUSE-SU-2026:1632-1

SUSE-SU-2026:1633-1

SUSE-SU-2026:1634-1

SUSE-SU-2026:1635-1

SUSE-SU-2026:1640-1

SUSE-SU-2026:21436-1

USN-8105-1

Affected Products

Freerdp

Linuxmint

Ubuntu

References · 95

• 🔥 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cc88-4j37-mw6j · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25954.json · Exploit
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1230-L1238 · Patch
• https://github.com/FreeRDP/FreeRDP/commit/1994e9844212a6dfe0ff12309fef520e888986b5 · Patch
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1133 · Patch
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L647 · Patch
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1350-L1359 · Patch
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1076 · Patch
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1347 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-25954 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22851 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23531 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23533 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29775 · Security Note
• https://ubuntu.com/security/CVE-2026-25952 · Vendor Advisory