Heap Use After Free in FreeRDP Remote Desktop Protocol Implementation

CVE-2026-25997

What is CVE-2026-25997?

A vulnerability in FreeRDP, an open-source implementation of the Remote Desktop Protocol, enables a heap use after free condition that arises from improper memory management. Specifically, the function xf_clipboard_format_equal attempts to read memory that has already been freed by xf_clipboard_formats_free, which is invoked during the auto-reconnect process. This problematic access occurs while another thread concurrently iterates over the same memory structure, leading to potential security risks such as data corruption or application crashes. The issue is addressed in version 3.23.0, which rectifies the memory handling to mitigate these risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References