Security readout for executives and security teams
Plain-English summary
CVE-2026-25955 affects FreeRDP before 3.23.0. A memory handling bug in the X11 client path can leave the program using graphics data after it was freed. The published impact is limited availability impact, not data theft or privilege escalation. Organizations using FreeRDP should update, especially where clients connect to external or less-trusted RDP servers.
Executive priority
Treat as a routine but timely client-side update. Business risk is mainly disruption or client crash potential, not confirmed compromise. Patch FreeRDP in normal vulnerability maintenance windows, with higher priority for administrators or users connecting to untrusted RDP services.
Technical view
The issue is a CWE-416 heap-use-after-free in xf_AppUpdateWindowFromSurface. A cached XImage can retain a data pointer aliasing an RDPGFX surface buffer after gdi_DeleteSurface frees surface->data. The advisory states FreeRDP versions prior to 3.23.0 are affected and 3.23.0 fixes it. CVSS 4.0 score is 5.5 with network attack vector and low availability impact.
Likely exposure
Exposure is limited to environments running FreeRDP versions earlier than 3.23.0. The described code path is in the X11 client window handling and RDPGFX surface processing. Confirm whether packaged, embedded, or workstation FreeRDP clients are present, including Linux desktop images and administrative tooling.
Exploitation context
The source bundle does not cite active exploitation, and KEV status is false. The CVSS vector includes E:P, indicating proof-of-concept maturity in the scoring data, but no exploit details are provided here. The vulnerability is remotely reachable by the CVSS network vector and does not require privileges or user interaction in the score.
Researcher notes
Evidence supports a stale XImage data pointer after gdi_DeleteSurface frees the backing surface buffer. The fix is referenced by upstream commit 169d358734509e82663a0d6a0085ae726d439d8e. No source in the bundle confirms active exploitation or broader product impact beyond FreeRDP before 3.23.0.
Mitigation direction
- Upgrade FreeRDP to version 3.23.0 or later.
- Apply vendor or distribution packages that include the FreeRDP fix.
- Prioritize systems connecting to external or less-trusted RDP servers.
- If immediate upgrade is unavailable, monitor FreeRDP vendor guidance for supported workarounds.
Validation and detection
- Inventory installed FreeRDP versions across endpoints and images.
- Flag FreeRDP versions earlier than 3.23.0 as affected.
- Confirm distribution packages include the upstream fix commit or equivalent patch.
- Review FreeRDP client usage where X11 and RDPGFX are enabled.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-25955 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
5.5MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4g54-x8v7-559xCVE reference · x_refsource_CONFIRM
- https://github.com/FreeRDP/FreeRDP/commit/169d358734509e82663a0d6a0085ae726d439d8eCVE reference · x_refsource_MISC
- https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1494-L1500CVE reference · x_refsource_MISC
- https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/libfreerdp/gdi/gfx.c#L1224-L1227CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.