CVE-2026-25952

CVE-2026-25952 : FreeRDP before 3.23.0 dereferences a freed xfAppWindow pointer when xf_rail_get_window returns an unprotected pointer from the railWindows hash, with the main thread potentially deleting the window while the RAIL channel thread still uses it. This use-after-free vulnerability aff...

CVE-2026-25952 FreeRDP has heap-use-after-free in xf_SetWindowMinMaxInfo

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xfSetWindowMinMaxInfo dereferences a freed xfAppWindow pointer because xfrailgetwindow in xfrailserverminmaxinfo returns an unprotected pointer from the railWindows hash table, and the main thread can...

CVE-2026-25952: Use After Free

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xfSetWindowMinMaxInfo dereferences a freed xfAppWindow pointer because xfrailgetwindow in xfrailserverminmaxinfo returns an unprotected pointer from the railWindows hash table, and the main thread can...

FreeRDP security vulnerabilities

FreeRDP is an open-source RDP protocol implementation developed by the FreeRDP team. Versions of FreeRDP prior to 3.23.0 contained security vulnerabilities. These vulnerabilities stemmed from the use of xfSetWindowMinMaxInfo, which reclaimed freed xfAppWindow pointers, potentially leading to reus...