CVE-2026-25955 is a critical use after free (CVSS 9.8) in the FreeRDP X11 client, where a cached image keeps pointing at a surface buffer that was already freed. Upgrade to FreeRDP 3.23.0, which fixes it. The record does not list it in CISA's KEV catalog, and no exploitation is reported in it.
What's affected
- FreeRDP before 3.23.0
- Fixed in FreeRDP 3.23.0
The code paths named in the record are in the X11 client under client/X11, so the xfreerdp family of builds is the place to look. The record gives no workaround. Distribution packages often backport fixes under their own version numbers, so check your vendor's security notice as well as the upstream number.
How to check if you're exposed
Ask the client for its version and compare it with 3.23.0:
xfreerdp /version
On Debian and Ubuntu style systems, dpkg -l | grep -i freerdp lists the installed packages, and on RPM based systems rpm -qa | grep -i freerdp does the same. Also look at anything that bundles FreeRDP: remote access tools, container images and appliance software.
If your distribution reports an older number, read its changelog for this CVE's entries before you decide you are exposed. Do not assume either way from the version string alone.
What to do now
- Upgrade FreeRDP to 3.23.0 or later, or to your distribution's build that lists this CVE as fixed.
- Update bundled copies in tools, images and kiosks, then confirm the version in the running environment.
- Until then, connect only to RDP servers you control, because the flawed code processes data the server sends.
- Add FreeRDP to your software inventory so version checks are a query.
- Re-run your dependency or image scan after the upgrade to confirm the finding clears.
Why it matters
CWE-416 is use after free: code keeps a pointer to memory after another part of the program has released it. xf_AppUpdateWindowFromSurface reuses a cached XImage whose data pointer references an RDPGFX surface buffer. gdi_DeleteSurface frees surface data without invalidating the appWindow image that aliases it, so the next reuse reads freed memory.
The shared lesson across this release is threading. Several of the FreeRDP issues fixed in 3.23.0 involve one thread freeing data while another still reads it, with no lock or lifetime protection. These bugs depend on timing, which makes them hard to reproduce and easy to underestimate. A score of 9.8 reflects the worst case: network reach, no privileges, no user interaction, and high impact on all three properties.
Quick check
Is this a server or a client bug?
The functions named in the record are in the X11 client code, so it concerns the client side of an RDP session. It is not a flaw in Windows Remote Desktop.
Is this the same bug as the other graphics one?
No. The sibling issue is about a freed window object. This one is about a freed pixel buffer that a cached image still points to. Both are fixed in 3.23.0.
Sources
- https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1111
- https://github.com/FreeRDP/FreeRDP/releases/tag/3.23.0
Last reviewed: 19 October 2026.
