CVE-2026-26986: FreeRDP has heap-use-after-free in rail_window_free
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, railwindowfree dereferences a freed xfAppWindow pointer during HashTableFree cleanup because xfrailwindowcommon calls free(appWindow) on title allocation failure without first removing the entry from the railWindows hash table, leaving a dangling pointer that is freed again on disconnect. Version 3.23.0 fixes the vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.23.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26986?
CVE-2026-26986 has a medium severity rating due to potential memory corruption issues.
How do I fix CVE-2026-26986?
To fix CVE-2026-26986, upgrade FreeRDP to version 3.23.0 or later.
What versions of FreeRDP are affected by CVE-2026-26986?
FreeRDP versions prior to 3.23.0 are affected by CVE-2026-26986.
What is the impact of CVE-2026-26986 on application stability?
CVE-2026-26986 may lead to application crashes or unexpected behaviors due to memory corruption.
Is there a workaround for CVE-2026-26986 if I cannot upgrade?
There are no known workarounds for CVE-2026-26986 other than upgrading FreeRDP to a safe version.