CVE Explorer

CVE-2026-25955

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reuses a cached `XImage` whose `data` pointer references a freed RDPGFX surface buffer, because `gdi_DeleteSurface` frees `surface->data` without invalidating the `appWindow->image` that aliases it. Version 3.23.0 fixes the issue.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:9ba9678b396e918e2a5c53bcea6e8594b6c268527318270211bd14f27f834033

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"FreeRDP","vendor":"FreeRDP","versions":[{"status":"affected","version":"< 3.23.0"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:216ffc9089dbccabbbfff445a6fad8f12ee2b821c265b97b3e8b7794f2ea73e1 · sha256:751373c5473c11d3… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.5,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE"},"metric_type":"cvssV4_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:216ffc9089dbccabbbfff445a6fad8f12ee2b821c265b97b3e8b7794f2ea73e1 · sha256:751373c5473c11d3… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-416","description":"CWE-416: Use After Free","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:216ffc9089dbccabbbfff445a6fad8f12ee2b821c265b97b3e8b7794f2ea73e1 · sha256:751373c5473c11d3… · /containers/cna/problemTypes/0/descriptions/0

Source references

7 source assertions

{"name":"https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1484-L1492","tags":["x_refsource_MISC"],"url":"https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1484-L1492"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:216ffc9089dbccabbbfff445a6fad8f12ee2b821c265b97b3e8b7794f2ea73e1 · sha256:751373c5473c11d3… · /containers/cna/references/2

{"name":"https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1494-L1500","tags":["x_refsource_MISC"],"url":"https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1494-L1500"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:216ffc9089dbccabbbfff445a6fad8f12ee2b821c265b97b3e8b7794f2ea73e1 · sha256:751373c5473c11d3… · /containers/cna/references/3

{"name":"https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1528","tags":["x_refsource_MISC"],"url":"https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1528"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:216ffc9089dbccabbbfff445a6fad8f12ee2b821c265b97b3e8b7794f2ea73e1 · sha256:751373c5473c11d3… · /containers/cna/references/4

{"name":"https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/libfreerdp/gdi/gfx.c#L1224-L1227","tags":["x_refsource_MISC"],"url":"https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/libfreerdp/gdi/gfx.c#L1224-L1227"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:216ffc9089dbccabbbfff445a6fad8f12ee2b821c265b97b3e8b7794f2ea73e1 · sha256:751373c5473c11d3… · /containers/cna/references/5

{"name":"https://github.com/FreeRDP/FreeRDP/commit/169d358734509e82663a0d6a0085ae726d439d8e","tags":["x_refsource_MISC"],"url":"https://github.com/FreeRDP/FreeRDP/commit/169d358734509e82663a0d6a0085ae726d439d8e"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:216ffc9089dbccabbbfff445a6fad8f12ee2b821c265b97b3e8b7794f2ea73e1 · sha256:751373c5473c11d3… · /containers/cna/references/1

{"tags":["exploit"],"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4g54-x8v7-559x"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:216ffc9089dbccabbbfff445a6fad8f12ee2b821c265b97b3e8b7794f2ea73e1 · sha256:751373c5473c11d3… · /containers/adp/0/references/0

{"name":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4g54-x8v7-559x","tags":["x_refsource_CONFIRM"],"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4g54-x8v7-559x"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:216ffc9089dbccabbbfff445a6fad8f12ee2b821c265b97b3e8b7794f2ea73e1 · sha256:751373c5473c11d3… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer