Unrated severityNVD Advisory· Published Feb 25, 2026· Updated Feb 26, 2026
FreeRDP has heap-use-after-free in rail_window_free
CVE-2026-26986
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, rail_window_free dereferences a freed xfAppWindow pointer during HashTable_Free cleanup because xf_rail_window_common calls free(appWindow) on title allocation failure without first removing the entry from the railWindows hash table, leaving a dangling pointer that is freed again on disconnect. Version 3.23.0 fixes the vulnerability.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
8- github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.cmitrex_refsource_MISC
- github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.cmitrex_refsource_MISC
- github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.cmitrex_refsource_MISC
- github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.cmitrex_refsource_MISC
- github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.cmitrex_refsource_MISC
- github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.cmitrex_refsource_MISC
- github.com/FreeRDP/FreeRDP/commit/b4f0f0a18fe53aa8d47d062f91471f4e9c5e0d51mitrex_refsource_MISC
- github.com/FreeRDP/FreeRDP/security/advisories/GHSA-crqx-g6x5-rx47mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.