CVE-2026-25997

CVE-2026-25997 affects FreeRDP prior to 3.23.0. The issue is a heap use-after-free in the clipboard path: the function xf_clipboard_format_equal reads freed lastSentFormats because xf_clipboard_formats_free frees the array while the X11 event thread concurrently iterates it in xf_clipboard_change...