CVE-2026-25955

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, "xfAppUpdateWindowFromSurface" reuses a cached "XImage" whose "data" pointer references a freed RDPGFX surface buffer, because "gdiDeleteSurface" frees "surface-data" without invalidating the "appWindow-imag...

CVE-2026-25953

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, "xfAppUpdateWindowFromSurface" reads from a freed "xfAppWindow" because the RDPGFX DVC thread obtains a bare pointer via "xfrailgetwindow" without any lifetime protection, while the main thread can...

CVE-2026-25955: Use After Free

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xfAppUpdateWindowFromSurface reuses a cached XImage whose data pointer references a freed RDPGFX surface buffer, because gdiDeleteSurface frees surface-data without invalidating the appWindow-image that...

CVE-2026-25953: Use After Free

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xfAppUpdateWindowFromSurface reads from a freed xfAppWindow because the RDPGFX DVC thread obtains a bare pointer via xfrailgetwindow without any lifetime protection, while the main thread can concurrently...