CVE-2026-25955

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-25955
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-25955.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-25955
Aliases
  • GHSA-4g54-x8v7-559x
Downstream
Related
Published
2026-02-25T20:32:42.458Z
Modified
2026-07-15T00:58:31.938430Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
FreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (stale XImage)
Details

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xf_AppUpdateWindowFromSurface reuses a cached XImage whose data pointer references a freed RDPGFX surface buffer, because gdi_DeleteSurface frees surface->data without invalidating the appWindow->image that aliases it. Version 3.23.0 fixes the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25955.json",
    "cwe_ids": [
        "CWE-416"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/freerdp/freerdp

Affected ranges

Type
GIT
Repo
https://github.com/freerdp/freerdp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b933ae18d9ad2a1d73c610868fcc30eb61654070
Fixed
169d358734509e82663a0d6a0085ae726d439d8e
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.23.0"
        }
    ]
}

Affected versions

1.*
1.0-beta1
1.0-beta2
1.0-beta4
1.0-beta5
1.0.0
1.0.1
1.1.0-beta+2013071101
1.1.0-beta1
1.1.0-beta1+android2
1.1.0-beta1+android3
1.1.0-beta1+android4
1.1.0-beta1+android5
1.1.0-beta1+ios1
1.1.0-beta1+ios2
1.1.0-beta1+ios3
1.1.0-beta1+ios4
1.2.0-beta1+android7
1.2.0-beta1+android9
2.*
2.0.0
2.0.0-beta1+android10
2.0.0-beta1+android11
2.0.0-rc0
2.0.0-rc1
2.0.0-rc2
2.0.0-rc3
2.0.0-rc4
3.*
3.0.0
3.0.0-beta1
3.0.0-beta2
3.0.0-beta3
3.0.0-beta4
3.0.0-rc0
3.1.0
3.2.0
3.3.0
3.4.0
3.5.0
3.5.1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-25955.json"
vanir_signatures 
[
    {
        "signature_version": "v1",
        "digest": {
            "function_hash": "230624877803178313183853038157178133264",
            "length": 518.0
        },
        "source": "https://github.com/freerdp/freerdp/commit/169d358734509e82663a0d6a0085ae726d439d8e",
        "signature_type": "Function",
        "target": {
            "file": "client/X11/xf_gfx.c",
            "function": "xf_graphics_pipeline_init"
        },
        "id": "CVE-2026-25955-4c320021",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "243529717739569533684677910977833101610",
                "307921445723320159618554933166517132440",
                "213455639638254885527558728264828985474",
                "2353051177811375233891963000348469859"
            ]
        },
        "source": "https://github.com/freerdp/freerdp/commit/169d358734509e82663a0d6a0085ae726d439d8e",
        "signature_type": "Line",
        "target": {
            "file": "client/X11/xf_window.c"
        },
        "id": "CVE-2026-25955-7048ed9a",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "function_hash": "124676779988898232143899520915483035523",
            "length": 176.0
        },
        "source": "https://github.com/freerdp/freerdp/commit/169d358734509e82663a0d6a0085ae726d439d8e",
        "signature_type": "Function",
        "target": {
            "file": "client/X11/xf_window.c",
            "function": "xf_AppWindowDestroyImage"
        },
        "id": "CVE-2026-25955-7509ce41",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "274989684726415854464860555426590600791",
                "157415152814815066604456711882283525613",
                "130389643594465153924391638423004511",
                "69614774208158716414427812049481401373",
                "301401017960183807966362045809666094476",
                "100051856654893783752645365936153427058",
                "43349210179461126525492169005781632617",
                "215538969033604108146732541947987911972",
                "290948695116854499007892397015936029216",
                "185438788870802339939463699230008602285",
                "62434136499166560226958797792779197958",
                "109999624526993878280757234893010676708"
            ]
        },
        "source": "https://github.com/freerdp/freerdp/commit/169d358734509e82663a0d6a0085ae726d439d8e",
        "signature_type": "Line",
        "target": {
            "file": "client/X11/xf_gfx.c"
        },
        "id": "CVE-2026-25955-8547faf9",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "249217399184350562114878016738027530299",
                "114958354134534920921718169867340966258",
                "22054594270502427431110768934478992215",
                "27190643845189031551534858640230522061",
                "307514238429116723752395879286764604255",
                "28530011447516391941862576764716015742",
                "80680984582061645344468879997002228621",
                "66026900180561348995929476936789856149",
                "116583118306453343983134646751243818886"
            ]
        },
        "source": "https://github.com/freerdp/freerdp/commit/169d358734509e82663a0d6a0085ae726d439d8e",
        "signature_type": "Line",
        "target": {
            "file": "client/X11/xf_window.h"
        },
        "id": "CVE-2026-25955-e8a02b08",
        "deprecated": false
    }
]
vanir_signatures_modified 
"2026-07-15T00:58:31Z"