PT-2026-22014 · Freerdp+2 · Freerdp+2

Ehdgks0627 · Published 2026-01-01 · Updated 2026-05-11 · CVE-2026-25997

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.23.0

Description FreeRDP is a free implementation of the Remote Desktop Protocol. A heap use after free condition exists in the clipboard handling functionality. Specifically, the xf clipboard format equal function reads memory that has already been freed by xf clipboard formats free during auto-reconnect within the cliprdr channel thread, while the X11 event thread concurrently iterates over it in xf clipboard changed. This occurs because xf clipboard formats free frees the lastSentFormats array while another thread is still accessing it.

Recommendations Update to version 3.23.0 or later.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2026:16014

BDU:2026-04150

CVE-2026-25997

GHSA-Q5J3-M6JF-3JQ4

OESA-2026-1516

OESA-2026-1517

OESA-2026-1518

OESA-2026-1519

OESA-2026-1520

OESA-2026-1521

OPENSUSE-SU-2026:10408-1

OPENSUSE-SU-2026:10611-1

OPENSUSE-SU-2026:20632-1

OPENSUSE-SU-2026:20657-1

SUSE-SU-2026:1632-1

SUSE-SU-2026:1633-1

SUSE-SU-2026:1634-1

SUSE-SU-2026:1635-1

SUSE-SU-2026:1640-1

SUSE-SU-2026:21436-1

USN-8105-1

Affected Products

Freerdp

Linuxmint

Ubuntu

References · 141

• 🔥 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q5j3-m6jf-3jq4 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25997.json · Exploit
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L831 · Patch
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L1884 · Patch
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L851-L855 · Patch
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L265 · Patch
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L616 · Patch
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L868-L875 · Patch
• https://github.com/FreeRDP/FreeRDP/commit/58409406afe7c2a8a71ed2dc8e22075be4f41c0c · Patch
• https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L1889 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-24491 · Security Note
• https://ubuntu.com/security/notices/USN-8105-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27015 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-25997 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25941 · Security Note