CVE-2026-25953: FreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (freed appWindow)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xfAppUpdateWindowFromSurface reads from a freed xfAppWindow because the RDPGFX DVC thread obtains a bare pointer via xfrailgetwindow without any lifetime protection, while the main thread can concurrently delete the window through a fastpath window-delete order. Version 3.23.0 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25953?
CVE-2026-25953 has a high severity due to the heap-use-after-free vulnerability that can lead to remote code execution.
How do I fix CVE-2026-25953?
To fix CVE-2026-25953, update FreeRDP to version 3.23.0 or later.
What software is affected by CVE-2026-25953?
CVE-2026-25953 affects FreeRDP versions prior to 3.23.0.
What is the impact of CVE-2026-25953?
The impact of CVE-2026-25953 can include potential remote code execution due to improper handling of freed memory.
Is there a workaround for CVE-2026-25953?
There are no official workarounds for CVE-2026-25953; updating to a patched version is recommended.