CVE-2026-25952 is a critical use after free (CVSS 9.8) in the FreeRDP X11 client, reached through RAIL window handling in xf_SetWindowMinMaxInfo. Upgrade to FreeRDP 3.23.0, which fixes it. The record does not list it in CISA's KEV catalog, and no exploitation is reported in it.
What's affected
- FreeRDP before 3.23.0
- Fixed in FreeRDP 3.23.0
The code paths named in the record are in the X11 client under client/X11, so the xfreerdp family of builds is the place to look. The record gives no workaround. Distribution packages often backport fixes under their own version numbers, so check your vendor's security notice as well as the upstream number.
How to check if you're exposed
Ask the client for its version and compare it with 3.23.0:
xfreerdp /version
On Debian and Ubuntu style systems, dpkg -l | grep -i freerdp lists the installed packages, and on RPM based systems rpm -qa | grep -i freerdp does the same. Also look at anything that bundles FreeRDP: remote access tools, container images and appliance software.
If your distribution reports an older number, read its changelog for this CVE's entries before you decide you are exposed. Do not assume either way from the version string alone.
What to do now
- Upgrade FreeRDP to 3.23.0 or later, or to your distribution's build that lists this CVE as fixed.
- Update bundled copies in tools, images and kiosks, then confirm the version in the running environment.
- Until then, connect only to RDP servers you control, because the flawed code processes data the server sends.
- Add FreeRDP to your software inventory so version checks are a query.
- Re-run your dependency or image scan after the upgrade to confirm the finding clears.
Why it matters
CWE-416 is use after free: code keeps a pointer to memory after another part of the program has released it. In this case xf_SetWindowMinMaxInfo dereferences a freed xfAppWindow pointer. The helper xf_rail_get_window returns a bare pointer from the railWindows hash table with no protection, and the main thread can delete that window through a window delete order while the RAIL channel thread is still using it.
The shared lesson across this release is threading. Several of the FreeRDP issues fixed in 3.23.0 involve one thread freeing data while another still reads it, with no lock or lifetime protection. These bugs depend on timing, which makes them hard to reproduce and easy to underestimate. A score of 9.8 reflects the worst case: network reach, no privileges, no user interaction, and high impact on all three properties.
Quick check
Is this a server or a client bug?
The functions named in the record are in the X11 client code, so it concerns the client side of an RDP session. It is not a flaw in Windows Remote Desktop.
What is RAIL?
RAIL is the RDP feature that shows individual remote application windows on the local desktop. The record ties this bug to that window handling, so sessions that use remote app windows are the relevant path.
Sources
- https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1167
- https://github.com/FreeRDP/FreeRDP/releases/tag/3.23.0
Last reviewed: 19 October 2026.
