Memory Dereference Vulnerability in FreeRDP Affects Remote Desktop Protocol

CVE-2026-25952

What is CVE-2026-25952?

FreeRDP, an open-source implementation of the Remote Desktop Protocol, has a vulnerability where the function xf_SetWindowMinMaxInfo can dereference a pointer that has already been freed. This happens when xf_rail_get_window retrieves an unprotected pointer from the railWindows hash table, leading to potential crashes or unexpected behaviors, as the main thread might delete the window while it is still in use by the RAIL channel thread. To mitigate this issue, users should upgrade to FreeRDP version 3.23.0 or later, which addresses this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References