CVE-2026-25955: FreeRDP Use-After-Free Vulnerability

CVE-2026-25955 Overview

CVE-2026-25955 is a Use-After-Free vulnerability affecting FreeRDP, the free implementation of the Remote Desktop Protocol. The vulnerability exists in the xf_AppUpdateWindowFromSurface function, which reuses a cached XImage whose data pointer references a freed RDPGFX surface buffer. This occurs because gdi_DeleteSurface frees surface->data without invalidating the appWindow->image that aliases it. The issue has been addressed in version 3.23.0.

Critical Impact

A remote attacker could potentially trigger a denial of service condition by exploiting the use-after-free condition in FreeRDP's X11 client graphics surface handling, leading to application crashes or memory corruption.

Affected Products

• FreeRDP versions prior to 3.23.0
• FreeRDP X11 client implementations using RDPGFX surface handling

Discovery Timeline

• 2026-02-25 - CVE-2026-25955 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-25955

Vulnerability Analysis

This Use-After-Free (CWE-416) vulnerability resides in the FreeRDP X11 client's window management code, specifically within the xf_window.c source file. The core issue stems from improper memory lifecycle management between two aliased pointers that reference the same underlying surface buffer data.

When an RDPGFX surface is deleted via gdi_DeleteSurface, the function properly frees surface->data. However, the corresponding appWindow->image structure maintains a stale pointer to this now-freed memory region. Subsequent calls to xf_AppUpdateWindowFromSurface attempt to reuse the cached XImage object, which still references the deallocated buffer. This creates a classic use-after-free condition where the application accesses memory that has been returned to the heap allocator.

The vulnerability can be triggered remotely over the network when a malicious RDP server sends crafted graphics surface commands that cause the client to delete and then reference the affected surface buffer.

Root Cause

The root cause is a missing invalidation step in the surface deletion workflow. When gdi_DeleteSurface frees the surface data buffer in libfreerdp/gdi/gfx.c, it does not notify or invalidate the appWindow->image pointer in the X11 client code. The XImage structure continues to hold a reference to the freed memory, creating a dangling pointer condition. Proper memory management requires that all aliases to a memory region be invalidated before or immediately after the memory is freed.

Attack Vector

The vulnerability is exploitable over the network, requiring no user interaction beyond establishing an RDP connection. An attacker operating a malicious RDP server could craft specific RDPGFX protocol messages to trigger surface creation, deletion, and subsequent window update operations in a sequence that exercises the use-after-free condition. The attack could result in application crashes (denial of service) or potentially more severe memory corruption depending on heap state and allocation patterns.

// Security fix - making xf_AppWindowDestroyImage accessible to properly clean up XImage
// Source: https://github.com/FreeRDP/FreeRDP/commit/169d358734509e82663a0d6a0085ae726d439d8e

 #include "xf_gfx.h"
 #include "xf_rail.h"
 #include "xf_utils.h"
+#include "xf_window.h"
 
 #include <X11/Xutil.h>

// Patch changes xf_AppWindowDestroyImage from static to externally visible
// This allows proper cleanup when surfaces are unmapped
// Source: https://github.com/FreeRDP/FreeRDP/commit/169d358734509e82663a0d6a0085ae726d439d8e

 	xf_unlock_x11(xfc);
 }
 
-static void xf_AppWindowDestroyImage(xfAppWindow* appWindow)
+void xf_AppWindowDestroyImage(xfAppWindow* appWindow)
 {
 	WINPR_ASSERT(appWindow);
 	if (appWindow->image)

Detection Methods for CVE-2026-25955

Indicators of Compromise

• FreeRDP client crashes with segmentation faults or memory access violations during RDP sessions
• Core dumps showing crashes within xf_AppUpdateWindowFromSurface or related X11 window functions
• Memory debugging tools (Valgrind, AddressSanitizer) reporting use-after-free in xf_window.c

Detection Strategies

• Deploy memory sanitizers (ASan) in development and testing environments to detect use-after-free conditions
• Monitor application crash logs for FreeRDP client instances showing memory corruption patterns
• Implement network monitoring for anomalous RDPGFX protocol sequences targeting surface creation/deletion

Monitoring Recommendations

• Enable crash reporting and core dump collection for FreeRDP client deployments
• Review RDP session logs for unusual connection patterns from untrusted servers
• Implement endpoint detection for FreeRDP process crashes correlating with network activity

How to Mitigate CVE-2026-25955

Immediate Actions Required

• Upgrade FreeRDP to version 3.23.0 or later immediately
• Restrict RDP connections to trusted servers only until patching is complete
• Consider disabling RDPGFX graphics pipeline if not required for operations
• Review network firewall rules to limit outbound RDP connections

Patch Information

The vulnerability has been fixed in FreeRDP version 3.23.0. The fix modifies the xf_AppWindowDestroyImage function visibility from static to external, allowing proper cleanup of the XImage structure when windows are unmapped. This ensures that the cached image reference is properly destroyed before the underlying surface buffer is freed, eliminating the dangling pointer condition.

For technical details about the fix, see the FreeRDP security commit and the GitHub Security Advisory GHSA-4g54-x8v7-559x.

Workarounds

• Avoid connecting to untrusted or unknown RDP servers until the patch can be applied
• Use network segmentation to isolate systems running vulnerable FreeRDP versions
• Consider using alternative RDP client implementations temporarily if upgrade is not immediately feasible

# Verify FreeRDP version to confirm patch status
xfreerdp --version

# If using package manager, upgrade FreeRDP
# For Debian/Ubuntu:
sudo apt update && sudo apt install freerdp2-x11

# For Fedora/RHEL:
sudo dnf update freerdp