CVE-2026-25997 is a critical use after free (CVSS 9.8) in the FreeRDP X11 client, triggered around clipboard format handling after an automatic reconnect. Upgrade to FreeRDP 3.23.0, which fixes it. The record does not list it in CISA's KEV catalog, and no exploitation is reported in it.
What's affected
- FreeRDP before 3.23.0
- Fixed in FreeRDP 3.23.0
The code paths named in the record are in the X11 client under client/X11, so the xfreerdp family of builds is the place to look. The record gives no workaround. Distribution packages often backport fixes under their own version numbers, so check your vendor's security notice as well as the upstream number.
How to check if you're exposed
Ask the client for its version and compare it with 3.23.0:
xfreerdp /version
On Debian and Ubuntu style systems, dpkg -l | grep -i freerdp lists the installed packages, and on RPM based systems rpm -qa | grep -i freerdp does the same. Also look at anything that bundles FreeRDP: remote access tools, container images and appliance software.
If your distribution reports an older number, read its changelog for this CVE's entries before you decide you are exposed. Do not assume either way from the version string alone.
What to do now
- Upgrade FreeRDP to 3.23.0 or later, or to your distribution's build that lists this CVE as fixed.
- Update bundled copies in tools, images and kiosks, then confirm the version in the running environment.
- Until then, connect only to RDP servers you control, because the flawed code processes data the server sends.
- Add FreeRDP to your software inventory so version checks are a query.
- Re-run your dependency or image scan after the upgrade to confirm the finding clears.
Why it matters
CWE-416 is use after free: code keeps a pointer to memory after another part of the program has released it. xf_clipboard_format_equal reads freed lastSentFormats memory. xf_clipboard_formats_free runs on the cliprdr channel thread during auto-reconnect and frees the array while the X11 event thread is still walking it in xf_clipboard_changed.
The shared lesson across this release is threading. Several of the FreeRDP issues fixed in 3.23.0 involve one thread freeing data while another still reads it, with no lock or lifetime protection. These bugs depend on timing, which makes them hard to reproduce and easy to underestimate. A score of 9.8 reflects the worst case: network reach, no privileges, no user interaction, and high impact on all three properties.
Quick check
Is this a server or a client bug?
The functions named in the record are in the X11 client code, so it concerns the client side of an RDP session. It is not a flaw in Windows Remote Desktop.
What makes reconnect relevant?
The record says the array is freed during auto-reconnect. A flaky network that triggers reconnects can therefore line up the two threads, which is a reason to patch kiosks and jump hosts first.
Sources
- https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L1884
- https://github.com/FreeRDP/FreeRDP/releases/tag/3.23.0
Last reviewed: 19 October 2026.
