PT-2026-22013 · Freerdp+2 · Freerdp+2

Ehdgks0627 · Published 2026-01-01 · Updated 2026-03-23 · CVE-2026-25959

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0

Description FreeRDP is a free implementation of the Remote Desktop Protocol. A heap use-after-free condition exists in the clipboard channel due to improper memory management within the xf cliprdr provide data function. Specifically, the function passes freed memory (pDstData) to XChangeProperty. This occurs because the cliprdr channel thread calls xf cliprdr server format data response, which processes clipboard data without appropriate locking, while the X11 event thread concurrently calls xf cliprdr clear cached data which frees the same data via xf cached data free.

Recommendations Update to version 3.23.0 or later.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-25959

GHSA-78XG-V4P2-4W3C

OPENSUSE-SU-2026:10408-1

OPENSUSE-SU-2026:20657-1

SUSE-SU-2026:1633-1

SUSE-SU-2026:21436-1

USN-8105-1

Affected Products

Freerdp

Linuxmint

Ubuntu

References · 74

• 🔥 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78xg-v4p2-4w3c · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25959.json · Exploit
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L2363 · Patch
• https://github.com/FreeRDP/FreeRDP/commit/d3e8b3b9365be96a4f11dda149d71b3287227d0a · Patch
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L1229-L1243 · Patch
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L200-L208 · Patch
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L2323-L2334 · Patch
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L1337-L1344 · Patch
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L933 · Patch
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L2295 · Patch
• https://ubuntu.com/security/CVE-2026-25955 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-25959 · Security Note
• https://ubuntu.com/security/CVE-2026-23732 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10408-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-25997 · Vendor Advisory