FreeRDP <3.23: Heap Use-After-Free in xf_cliprdr via XChangeProperty
CVE-2026-25959 Published on February 25, 2026

FreeRDP has heap-use-after-free in xf_cliprdr_provide_data_
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_cliprdr_provide_data_` passes freed `pDstData` to `XChangeProperty` because the cliprdr channel thread calls `xf_cliprdr_server_format_data_response` which converts and uses the clipboard data without holding any lock, while the X11 event thread concurrently calls `xf_cliprdr_clear_cached_data` `HashTable_Clear` which frees the same data via `xf_cached_data_free`, triggering a heap use after free. Version 3.23.0 fixes the issue.

NVD

Weakness Type

What is a Dangling pointer Vulnerability?

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

CVE-2026-25959 has been classified to as a Dangling pointer vulnerability or weakness.


Products Associated with CVE-2026-25959

Want to know whenever a new CVE is published for FreeRDP? stack.watch will email you.

FreeRDP
 

Affected Versions

FreeRDP Version < 3.23.0 is affected by CVE-2026-25959

Exploit Probability

EPSS
0.15%
Percentile
35.81%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.