High severity7.5NVD Advisory· Published Feb 25, 2026· Updated Jun 17, 2026
CVE-2026-25954
CVE-2026-25954
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xf_rail_server_local_move_size dereferences a freed xfAppWindow pointer because xf_rail_get_window returns an unprotected pointer from the railWindows hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
5- osv-coords2 versionspkg:rpm/opensuse/freerdp&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/freerdp2&distro=openSUSE%20Tumbleweed
< 3.24.1-1.1+ 1 more
- (no CPE)range: < 3.24.1-1.1
- (no CPE)range: < 2.11.7-8.1
Patches
Vulnerability mechanics
References
8- github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.cnvdPatch
- github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.cnvdPatch
- github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.cnvdPatch
- github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.cnvdPatch
- github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.cnvdPatch
- github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.cnvdPatch
- github.com/FreeRDP/FreeRDP/commit/1994e9844212a6dfe0ff12309fef520e888986b5nvdPatch
- github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cc88-4j37-mw6jnvdExploitMitigationPatchVendor Advisory
News mentions
0No linked articles in our index yet.