CVE-2026-25959 is a critical use after free (CVSS 9.8) in the FreeRDP X11 client, this time in clipboard redirection, where freed data is handed to XChangeProperty. Upgrade to FreeRDP 3.23.0, which fixes it. The record does not list it in CISA's KEV catalog, and no exploitation is reported in it.
What's affected
- FreeRDP before 3.23.0
- Fixed in FreeRDP 3.23.0
The code paths named in the record are in the X11 client under client/X11, so the xfreerdp family of builds is the place to look. The record gives no workaround. Distribution packages often backport fixes under their own version numbers, so check your vendor's security notice as well as the upstream number.
How to check if you're exposed
Ask the client for its version and compare it with 3.23.0:
xfreerdp /version
On Debian and Ubuntu style systems, dpkg -l | grep -i freerdp lists the installed packages, and on RPM based systems rpm -qa | grep -i freerdp does the same. Also look at anything that bundles FreeRDP: remote access tools, container images and appliance software.
If your distribution reports an older number, read its changelog for this CVE's entries before you decide you are exposed. Do not assume either way from the version string alone.
What to do now
- Upgrade FreeRDP to 3.23.0 or later, or to your distribution's build that lists this CVE as fixed.
- Update bundled copies in tools, images and kiosks, then confirm the version in the running environment.
- Until then, connect only to RDP servers you control, because the flawed code processes data the server sends.
- Add FreeRDP to your software inventory so version checks are a query.
- Re-run your dependency or image scan after the upgrade to confirm the finding clears.
Why it matters
CWE-416 is use after free: code keeps a pointer to memory after another part of the program has released it. xf_cliprdr_provide_data_ passes freed pDstData to XChangeProperty. The cliprdr channel thread converts and uses clipboard data without holding a lock, while the X11 event thread calls xf_cliprdr_clear_cached_data, which clears a hash table and frees the same data.
The shared lesson across this release is threading. Several of the FreeRDP issues fixed in 3.23.0 involve one thread freeing data while another still reads it, with no lock or lifetime protection. These bugs depend on timing, which makes them hard to reproduce and easy to underestimate. A score of 9.8 reflects the worst case: network reach, no privileges, no user interaction, and high impact on all three properties.
Quick check
Is this a server or a client bug?
The functions named in the record are in the X11 client code, so it concerns the client side of an RDP session. It is not a flaw in Windows Remote Desktop.
Should I disable clipboard redirection?
The record names no workaround, but turning off clipboard redirection in sessions that do not need it reduces the code that runs. That is general hygiene and not a replacement for the upgrade.
Sources
- https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L265
- https://github.com/FreeRDP/FreeRDP/releases/tag/3.23.0
Last reviewed: 19 October 2026.
