Heap Use After Free in FreeRDP Implementation of Remote Desktop Protocol

CVE-2026-25959

What is CVE-2026-25959?

A vulnerability exists in FreeRDP, specifically in the handling of clipboard data within the Remote Desktop Protocol. The issue arises when the xf_cliprdr_provide_data_ function passes freed pDstData to XChangeProperty. This occurs because the cliprdr channel thread processes clipboard data without adequate locking, while concurrently, the X11 event thread may clear the same cached data leading to a heap use after free condition. The vulnerability has been resolved in version 3.23.0.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References