CVE-2026-25954: FreeRDP Use-After-Free Vulnerability

CVE-2026-25954 Overview

CVE-2026-25954 is a Use After Free vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol. The vulnerability exists in the xf_rail_server_local_move_size function, which dereferences a freed xfAppWindow pointer due to improper synchronization between threads. The xf_rail_get_window function returns an unprotected pointer from the railWindows hash table, and the main thread can concurrently delete the window via a window delete order while the RAIL channel thread is still using the pointer.

Critical Impact

This race condition vulnerability can lead to memory corruption and potential denial of service when a FreeRDP client processes concurrent RAIL (Remote Applications Integrated Locally) window operations from a malicious or compromised RDP server.

Affected Products

• FreeRDP versions prior to 3.23.0
• FreeRDP X11 client with RAIL support enabled
• Applications built on vulnerable FreeRDP libraries

Discovery Timeline

• 2026-02-25 - CVE-2026-25954 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-25954

Vulnerability Analysis

This Use After Free vulnerability (CWE-416) occurs due to a race condition in FreeRDP's RAIL subsystem. The RAIL feature allows remote Windows applications to appear as local windows on the client system, requiring complex window management between multiple threads. The vulnerability stems from the xf_rail_get_window function returning a raw pointer from the railWindows hash table without proper locking mechanisms to prevent concurrent modification.

When the main thread processes a window delete order from the RDP server, it can free the xfAppWindow structure while the RAIL channel thread still holds a reference to that memory. Any subsequent dereferencing of this stale pointer in functions like xf_rail_server_local_move_size results in accessing freed memory, which can cause crashes or potentially enable memory corruption.

The vulnerability is exploitable over the network by a malicious RDP server that sends carefully timed window management commands, though it requires no authentication or user interaction beyond establishing an RDP connection with RAIL support.

Root Cause

The root cause is a missing synchronization mechanism when accessing window objects from the shared railWindows hash table. The hash table is accessed by multiple threads concurrently without proper locking, creating a Time-of-Check Time-of-Use (TOCTOU) race condition. When xf_rail_get_window retrieves a pointer, there is no guarantee that the pointer remains valid while being used, as another thread may free the underlying memory at any point.

Attack Vector

An attacker operating a malicious RDP server can exploit this vulnerability by sending rapid sequences of RAIL window creation and deletion orders. The attack exploits the timing window between when the RAIL channel thread retrieves a window pointer and when it finishes using it. By sending a window delete order while a move/resize operation is in progress, the attacker can trigger the use-after-free condition.

The attack requires:

1. A victim connecting to a malicious RDP server with RAIL support enabled
2. The server sending concurrent window operations to create a race condition
3. Precise timing to ensure the pointer is dereferenced after being freed

// Security patch demonstrating the fix - adding proper hash table locking
// Source: https://github.com/FreeRDP/FreeRDP/commit/1994e9844212a6dfe0ff12309fef520e888986b5
 	}
 	if (xfc->remote_app)
 	{
+		Window w = 0;
+		HashTable_Lock(xfc->railWindows);
 		if (!xfc->appWindow)
-		{
 			WLog_WARN(TAG, "xf_Pointer: Invalid appWindow");
-			return 0;
-		}
-		return xfc->appWindow->handle;
+		else
+			w = xfc->appWindow->handle;
+		HashTable_Unlock(xfc->railWindows);
+		return w;
 	}
 	else
 	{

The fix introduces proper locking around hash table access using HashTable_Lock and HashTable_Unlock to ensure thread-safe window object access.

Detection Methods for CVE-2026-25954

Indicators of Compromise

• Unexpected FreeRDP client crashes during RAIL sessions with remote applications
• Core dumps or crash logs showing segmentation faults in xf_rail.c functions
• Memory access violations in the RAIL channel processing threads
• Unusual patterns of rapid window creation/deletion commands in RDP session logs

Detection Strategies

• Monitor for FreeRDP client process crashes that occur during remote application sessions
• Implement application crash monitoring with stack trace analysis for patterns involving xf_rail_get_window or xf_rail_server_local_move_size
• Review RDP session logs for anomalous RAIL window operation patterns that may indicate exploitation attempts
• Deploy endpoint detection rules that flag FreeRDP crashes with memory corruption signatures

Monitoring Recommendations

• Enable crash dump collection for FreeRDP client processes to capture exploitation attempts
• Monitor for unusual RDP connection patterns to unknown or suspicious servers
• Implement network monitoring for RDP connections that exhibit high volumes of RAIL window operations
• Track FreeRDP version deployments to identify systems running vulnerable versions prior to 3.23.0

How to Mitigate CVE-2026-25954

Immediate Actions Required

• Update FreeRDP to version 3.23.0 or later immediately
• If immediate patching is not possible, disable RAIL support when connecting to untrusted RDP servers
• Review and restrict which RDP servers users are permitted to connect to
• Audit systems for deployed FreeRDP versions and prioritize updates

Patch Information

FreeRDP version 3.23.0 addresses this vulnerability by implementing proper hash table locking around window object access. The fix ensures that when accessing window objects from the railWindows hash table, the table is locked to prevent concurrent modification by other threads. The patch introduces HashTable_Lock and HashTable_Unlock calls in the affected code paths and adds a new xf_rail_return_window function to properly release window references.

The security fix can be reviewed in FreeRDP Commit 1994e98. Additional technical details are available in the GitHub Security Advisory GHSA-cc88-4j37-mw6j.

Workarounds

• Disable RAIL functionality by using the /RemoteApp:0 option when connecting via FreeRDP
• Avoid connecting to untrusted or unknown RDP servers with RAIL support enabled
• Use network-level controls to restrict RDP connections to known trusted servers only
• Consider using alternative RDP clients until FreeRDP can be updated

# Configuration example - Disable RAIL when connecting to RDP servers
# Use the -RemoteApp or /RemoteApp option to disable RAIL functionality
xfreerdp /v:server.example.com /u:username /RemoteApp:0

# Alternatively, compile FreeRDP without RAIL support
cmake -DWITH_RAIL=OFF /path/to/freerdp/source
make && make install