CVE-2026-25953 is a critical use after free (CVSS 9.8) in the FreeRDP X11 client, reached when the graphics pipeline updates a window from a surface. Upgrade to FreeRDP 3.23.0, which fixes it. The record does not list it in CISA's KEV catalog, and no exploitation is reported in it.
What's affected
- FreeRDP before 3.23.0
- Fixed in FreeRDP 3.23.0
The code paths named in the record are in the X11 client under client/X11, so the xfreerdp family of builds is the place to look. The record gives no workaround. Distribution packages often backport fixes under their own version numbers, so check your vendor's security notice as well as the upstream number.
How to check if you're exposed
Ask the client for its version and compare it with 3.23.0:
xfreerdp /version
On Debian and Ubuntu style systems, dpkg -l | grep -i freerdp lists the installed packages, and on RPM based systems rpm -qa | grep -i freerdp does the same. Also look at anything that bundles FreeRDP: remote access tools, container images and appliance software.
If your distribution reports an older number, read its changelog for this CVE's entries before you decide you are exposed. Do not assume either way from the version string alone.
What to do now
- Upgrade FreeRDP to 3.23.0 or later, or to your distribution's build that lists this CVE as fixed.
- Update bundled copies in tools, images and kiosks, then confirm the version in the running environment.
- Until then, connect only to RDP servers you control, because the flawed code processes data the server sends.
- Add FreeRDP to your software inventory so version checks are a query.
- Re-run your dependency or image scan after the upgrade to confirm the finding clears.
Why it matters
CWE-416 is use after free: code keeps a pointer to memory after another part of the program has released it. Here xf_AppUpdateWindowFromSurface reads from a freed xfAppWindow. The RDPGFX dynamic channel thread gets a bare pointer through xf_rail_get_window without lifetime protection, while the main thread can delete the same window through a fastpath window delete order.
The shared lesson across this release is threading. Several of the FreeRDP issues fixed in 3.23.0 involve one thread freeing data while another still reads it, with no lock or lifetime protection. These bugs depend on timing, which makes them hard to reproduce and easy to underestimate. A score of 9.8 reflects the worst case: network reach, no privileges, no user interaction, and high impact on all three properties.
Quick check
Is this a server or a client bug?
The functions named in the record are in the X11 client code, so it concerns the client side of an RDP session. It is not a flaw in Windows Remote Desktop.
Why do two CVEs mention the same helper?
Both xf_rail_get_window callers get an unprotected pointer to a window that another thread can delete. The fix release addresses these as separate issues, so track each CVE even if you patch once.
Sources
- https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1167
- https://github.com/FreeRDP/FreeRDP/releases/tag/3.23.0
Last reviewed: 19 October 2026.
