Security readout for executives and security teams
Plain-English summary
FreeRDP versions before 3.23.0 have a memory safety bug in X11 clipboard handling. A race condition can make the client use clipboard data after it has been freed. The published impact is limited to low availability impact, but affected remote desktop client deployments should update because the fix is available.
Executive priority
Treat as a routine but timely client update. Business risk appears availability-focused rather than data theft based on published scoring, and a fixed version is available. Prioritize environments relying on FreeRDP for operational remote access.
Technical view
CVE-2026-25959 is a CWE-416 heap use-after-free in FreeRDP’s X11 cliprdr path. `xf_cliprdr_provide_data_` can pass freed `pDstData` to `XChangeProperty` when the cliprdr channel thread and X11 event thread concurrently process and clear cached clipboard data without adequate locking. FreeRDP before 3.23.0 is affected; 3.23.0 fixes it.
Likely exposure
Exposure is most likely where FreeRDP clients before 3.23.0 are used, especially builds using the X11 clipboard redirection code. The source bundle does not identify affected downstream packages or operating system distributions, so packaged versions require separate vendor verification.
Exploitation context
The CVSS v4 score is 5.5 with network attack vector, low attack complexity, no privileges, no user interaction, and low availability impact. The vector includes E:P, indicating proof-of-concept maturity, but the provided sources do not report active exploitation and KEV is false.
Researcher notes
The bug is a race between clipboard data conversion/use and cached data clearing in `client/X11/xf_cliprdr.c`. The advisory attributes the issue to missing locking around data use while another thread clears the hash table and frees cached data. The provided evidence does not establish broader impact beyond FreeRDP before 3.23.0.
Mitigation direction
- Upgrade FreeRDP to version 3.23.0 or later.
- Prioritize updates on systems using FreeRDP client clipboard functionality.
- Check operating system or package vendor advisories for backported fixes.
- If immediate upgrade is blocked, follow FreeRDP or vendor guidance for supported workarounds.
Validation and detection
- Inventory systems and applications that include or launch FreeRDP.
- Confirm installed FreeRDP versions are 3.23.0 or later.
- For packaged builds, verify vendor changelogs reference CVE-2026-25959 or the fixing commit.
- Confirm vulnerability scanners recognize fixed or backported package versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-25959 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
5.5MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78xg-v4p2-4w3cCVE reference · x_refsource_CONFIRM
- https://github.com/FreeRDP/FreeRDP/commit/d3e8b3b9365be96a4f11dda149d71b3287227d0aCVE reference · x_refsource_MISC
- https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_cliprdr.c#L1337-L1344CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.