CVE-2026-25955: FreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (stale XImage)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xfAppUpdateWindowFromSurface reuses a cached XImage whose data pointer references a freed RDPGFX surface buffer, because gdiDeleteSurface frees surface->data without invalidating the appWindow->image that aliases it. Version 3.23.0 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25955?
CVE-2026-25955 has been classified as a medium severity vulnerability.
How do I fix CVE-2026-25955?
To fix CVE-2026-25955, upgrade FreeRDP to version 3.23.0 or later.
What are the potential risks of CVE-2026-25955?
The potential risks of CVE-2026-25955 include application crashes and possible remote code execution due to improper memory handling.
Is my version of FreeRDP affected by CVE-2026-25955?
Any version of FreeRDP prior to 3.23.0 is affected by CVE-2026-25955.
What does CVE-2026-25955 affect specifically in FreeRDP?
CVE-2026-25955 affects the `xf_AppUpdateWindowFromSurface` function, which improperly handles memory for RDPGFX surface buffers.