Remote Desktop Protocol Vulnerability in FreeRDP Software by FreeRDP

CVE-2026-25953

What is CVE-2026-25953?

A use-after-free vulnerability exists in FreeRDP's implementation of the Remote Desktop Protocol, specifically within the xf_AppUpdateWindowFromSurface function. In versions before 3.23.0, a bare pointer is accessed without proper lifetime management, which can lead to instability and potential exploitation. This issue arises when the RDPGFX DVC thread obtains a pointer via xf_rail_get_window, while the main thread may concurrently delete the related window, resulting in access to invalid memory. Users are urged to upgrade to version 3.23.0 or later to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References