Unrated severityNVD Advisory· Published Feb 25, 2026· Updated Feb 26, 2026
FreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (stale XImage)
CVE-2026-25955
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xf_AppUpdateWindowFromSurface reuses a cached XImage whose data pointer references a freed RDPGFX surface buffer, because gdi_DeleteSurface frees surface->data without invalidating the appWindow->image that aliases it. Version 3.23.0 fixes the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3Patches
Vulnerability mechanics
References
6- github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.cmitrex_refsource_MISC
- github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.cmitrex_refsource_MISC
- github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.cmitrex_refsource_MISC
- github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/libfreerdp/gdi/gfx.cmitrex_refsource_MISC
- github.com/FreeRDP/FreeRDP/commit/169d358734509e82663a0d6a0085ae726d439d8emitrex_refsource_MISC
- github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4g54-x8v7-559xmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.