Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_local_move_size` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-25954 FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_local_move_size` dereferences a freed `xfAppWindow` pointer … https://www.cve.org/CVERecord?id=CVE-2026-25954
Post summary
The CVE-2026-25954 vulnerability in FreeRDP involves a use‑after‑free in the `xf_rail_server_local_move_size` function before version 3.23.0.
CVE-2026-25954 FreeRDP Use-After-Free Vulnerability in RAIL Channel Window Management https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25954 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
A new use‑after‑free vulnerability (CVE‑2026‑25954) in FreeRDP’s RAIL channel window management has been disclosed, with links to detailed information and a vulnerability notification.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | freerdp | freerdp | - | - | - |