CVE-2026-25959: FreeRDP has heap-use-after-free in xf_cliprdr_provide_data_
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xfcliprdrprovidedata passes freed pDstData to XChangeProperty because the cliprdr channel thread calls xfcliprdrserverformatdataresponse which converts and uses the clipboard data without holding any lock, while the X11 event thread concurrently calls xfcliprdrclearcacheddata → HashTableClear which frees the same data via xfcacheddatafree, triggering a heap use after free. Version 3.23.0 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25959?
The severity of CVE-2026-25959 is classified as a high-severity vulnerability due to potential memory corruption.
How do I fix CVE-2026-25959?
To fix CVE-2026-25959, update FreeRDP to version 3.23.0 or later.
What is affected by CVE-2026-25959?
CVE-2026-25959 affects FreeRDP versions prior to 3.23.0.
What type of vulnerability is CVE-2026-25959?
CVE-2026-25959 is a memory corruption vulnerability due to improper handling of clipboard data.
Can CVE-2026-25959 be exploited remotely?
Yes, CVE-2026-25959 can potentially be exploited remotely if the vulnerable software is used in a networked environment.