PT-2026-22012 · Freerdp+3 · Freerdp+3

Ehdgks0627 · Published 2026-01-01 · Updated 2026-06-15 · CVE-2026-25955

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0

Description FreeRDP is a free implementation of the Remote Desktop Protocol. A flaw exists in the xf AppUpdateWindowFromSurface function where a cached XImage’s data pointer can reference a freed RDPGFX surface buffer. This occurs because gdi DeleteSurface frees surface->data without invalidating the appWindow->image that aliases it. This can lead to a use-after-free condition.

Recommendations Update to version 3.23.0 or later.

Exploit

Fix

DoS

RCE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2026-04149

CVE-2026-25955

GHSA-4G54-X8V7-559X

OPENSUSE-SU-2026:10408-1

OPENSUSE-SU-2026:20657-1

SUSE-SU-2026:1633-1

SUSE-SU-2026:21436-1

USN-8105-1

Affected Products

Freerdp

Linuxmint

Red Os

Ubuntu

References · 78

• 🔥 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4g54-x8v7-559x · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25955.json · Exploit
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1494-L1500 · Patch
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1528 · Patch
• https://github.com/FreeRDP/FreeRDP/commit/169d358734509e82663a0d6a0085ae726d439d8e · Patch
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1484-L1492 · Patch
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/libfreerdp/gdi/gfx.c#L1224-L1227 · Patch
• https://ubuntu.com/security/CVE-2026-26965 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27015 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-22855 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23534 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-25955 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8105-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23883 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-25997 · Vendor Advisory