CVE-2026-25952: 
NixOS vulnerability analysis and mitigation

CVE-2026-25952 is a heap use-after-free vulnerability in FreeRDP's X11 client implementation, specifically in the xf_SetWindowMinMaxInfo function. It affects all FreeRDP versions prior to 3.23.0 and arises from a race condition between the RAIL SVC channel thread and the main thread during concurrent window management operations. The vulnerability was disclosed on February 25, 2026, and fixed in version 3.23.0. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is a use-after-free (CWE-416) race condition in the X11 RAIL client code. The RAIL SVC channel thread (T6) calls xf_rail_get_window in xf_rail_server_min_max_info, which returns an unprotected raw pointer to an xfAppWindow struct from the railWindows hash table. Concurrently, the main thread (T2) processes a window delete order, triggering xf_rail_window_delete → xf_rail_del_window → HashTable_Remove, which invokes the hash table's value destructor rail_window_free → xf_DestroyWindow → free(appWindow). When the RAIL thread subsequently dereferences appWindow->handle inside xf_SetWindowMinMaxInfo via XSetWMNormalHints, the memory has already been freed, resulting in a heap-use-after-free. A proof-of-concept demonstrating the issue with AddressSanitizer output is included in the GitHub security advisory (GitHub Advisory, Patch Commit).

A malicious RDP server can trigger this vulnerability remotely without authentication or user interaction by sending crafted RAIL ServerMinMaxInfo PDUs while simultaneously issuing window delete orders. The primary impact is a client-side crash (denial of service), but depending on heap allocator behavior and surrounding heap layout, the heap corruption could potentially be leveraged for arbitrary code execution on the connecting client. Secondary risks include possible sensitive memory disclosure from the freed heap region (GitHub Advisory).

A proof-of-concept exploit is publicly available via the GitHub security advisory, demonstrating the vulnerability using AddressSanitizer-instrumented builds. The EPSS score is approximately 0.066%, indicating low current exploitation probability. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability requires the attacker to control or impersonate an RDP server that supports RAIL (RemoteApp) mode (GitHub Advisory).

1. Set up a malicious RAIL-capable RDP server: Configure a rogue RDP server that supports the Remote Applications Integrated Locally (RAIL) extension and can send arbitrary RAIL protocol messages to connecting clients.
2. Lure a victim to connect: Induce a target running a vulnerable FreeRDP X11 client (version < 3.23.0) to connect to the malicious server, e.g., via a phishing link or by intercepting an existing RDP connection (man-in-the-middle).
3. Initiate a RemoteApp session: Send a window create order to the client to establish an xfAppWindow entry in the railWindows hash table (e.g., launch notepad.exe as a RemoteApp).
4. Trigger the race condition: Rapidly and repeatedly send RAIL ServerMinMaxInfo PDUs to the client (causing the RAIL channel thread to call xf_rail_get_window and enter xf_SetWindowMinMaxInfo) while simultaneously sending a window delete order (causing the main thread to call HashTable_Remove → xf_DestroyWindow → free(appWindow)).
5. Achieve heap-use-after-free: When the timing aligns, the RAIL channel thread dereferences the freed appWindow->handle pointer inside XSetWMNormalHints, triggering a heap-use-after-free. This results in a crash (DoS) or, depending on heap layout, potential code execution on the client (GitHub Advisory).

• Process: Unexpected crash or abort of the xfreerdp process, particularly when using RemoteApp (/app: mode); crash dumps referencing xf_SetWindowMinMaxInfo, xf_rail_server_min_max_info, or XSetWMNormalHints in the stack trace.
• Logs: AddressSanitizer output (if enabled) showing heap-use-after-free at xf_window.c:1128 or xf_rail.c:1178; FreeRDP debug logs showing rapid window create/delete cycles for the same window ID.
• Network: High-frequency RAIL ServerMinMaxInfo PDUs interleaved with window delete orders from the RDP server, observable via packet capture on the RDP session (TCP port 3389).
• File System: Core dump files generated by the xfreerdp process in the working directory or /var/crash/ following an unexpected termination.

Upgrade FreeRDP to version 3.23.0 or later, which resolves the issue by holding the railWindows hash table lock for the entire duration of appWindow usage in all RAIL SVC handler functions (via the new xf_rail_return_window mechanism). If immediate patching is not possible, restrict network access to systems running FreeRDP clients so they can only connect to trusted RDP servers, and avoid using RemoteApp (/app:) mode against untrusted servers. Linux distribution packages (Fedora, Ubuntu, SUSE, AlmaLinux, Rocky Linux, Red Hat, Debian) have released updated packages incorporating the fix (GitHub Advisory, Patch Commit).

The vulnerability was reported by security researcher ehdgks0627 and published by FreeRDP maintainer akallabeth as a GitHub Security Advisory rated "Moderate" on February 25, 2026. Coverage appeared on Phoronix (noting the FreeRDP 3.23.0 release), Linux security news aggregators, and various CVE tracking feeds shortly after disclosure. Multiple Linux distributions (Fedora, Ubuntu, SUSE, AlmaLinux, Rocky Linux, Red Hat, Debian) issued security advisories and updated packages within weeks of the disclosure (GitHub Advisory).