Remote Desktop Protocol Implementation Vulnerability in FreeRDP

CVE-2026-26986

What is CVE-2026-26986?

FreeRDP, a free implementation of the Remote Desktop Protocol, has a vulnerability where the rail_window_free function can dereference a freed xfAppWindow pointer. This occurs during HashTable_Free cleanup, as a failure to allocate memory leads to a call to free(appWindow) without removing the entry from the railWindows hash table first. The result is a dangling pointer that can be freed again upon disconnect, creating a potential security hazard. The issue has been addressed in version 3.23.0, which rectifies the pointer handling.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References