CVE-2026-25953: 
NixOS vulnerability analysis and mitigation

CVE-2026-25953 is a heap use-after-free (UAF) vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol, affecting all versions prior to 3.23.0. The flaw exists in the xf_AppUpdateWindowFromSurface function within the X11 client, where a race condition between two threads allows access to freed memory. It was disclosed on February 25, 2026, and patched in version 3.23.0. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (FreeRDP Advisory).

The root cause is a thread-safety flaw classified as CWE-416 (Use After Free). The RDPGFX DVC thread processes EndFrame PDUs, triggering gdi_UpdateSurfaces → gdi_WindowUpdate → xf_AppUpdateWindowFromSurface, which calls xf_rail_get_window to obtain a bare (unprotected) pointer to an xfAppWindow object. Concurrently, the main thread can process a fastpath window-delete order, calling xf_rail_window_delete → xf_rail_del_window → HashTable_Remove → rail_window_free → xf_DestroyWindow → free(appWindow). Because the two threads hold different locks (context->mux for the GFX thread and rdp_update_lock for the main thread), there is no serialization between them, allowing the DVC thread to dereference the freed appWindow pointer at fields such as surfaceId, width, and height. The same pattern also exists in xf_rail_paint_surface. The fix (commit 1994e98) introduces hash table locking around xf_rail_get_window and a paired xf_rail_return_window function to hold the lock until the caller is done with the pointer (FreeRDP Advisory, FreeRDP Commit).

Successful exploitation by a malicious RDP server (or via a man-in-the-middle position) can cause a client-side heap use-after-free, resulting in a crash (denial of service) or heap corruption. Depending on allocator behavior and surrounding heap layout, the corruption may be leveraged for arbitrary code execution on the connecting client system. The attack requires no authentication and no user interaction beyond the client initiating an RDP connection to a malicious server (FreeRDP Advisory).

A proof-of-concept scenario is documented in the GitHub Security Advisory (GHSA-p6rq-rxpc-rh3p), including AddressSanitizer output confirming the UAF, but no standalone weaponized exploit code has been publicly released. The CVSS v4.0 exploit maturity is rated as PROOF_OF_CONCEPT. There is no evidence of in-the-wild exploitation as of the time of this report, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.066%, indicating low current exploitation probability. The vulnerability is network-exploitable with no privileges or user interaction required (FreeRDP Advisory).

1. Set up a malicious RDP server: Configure a rogue RDP server that supports the RAIL (Remote Application Integrated Locally) extension and the RDPGFX dynamic virtual channel (DRDYNVC). Tools such as a custom FreeRDP server build or a modified RDP server implementation can be used.
2. Lure the client to connect: Trick a FreeRDP X11 client (running a version < 3.23.0) into connecting to the malicious server, e.g., using flags /gdi:sw /gfx /app:program:notepad.exe /cert:ignore.
3. Create a RAIL window and map a GFX surface: The server creates a RAIL application window and maps an RDPGFX surface to it via a MapSurfaceToWindow PDU, establishing the window-to-surface association in the client.
4. Flood the client with GFX frames: Send a rapid burst of GFX SolidFill + EndFrame PDUs through the DRDYNVC channel. This causes the client's DVC thread (T-GFX) to continuously call gdi_EndFrame → gdi_UpdateSurfaces → xf_AppUpdateWindowFromSurface, holding a bare pointer to the xfAppWindow.
5. Trigger concurrent window deletion: After approximately 10 or more frames, simultaneously send a fastpath window-delete order for the same RAIL window. The main thread processes this order, freeing the xfAppWindow via xf_DestroyWindow.
6. UAF triggered: The DVC thread dereferences the now-freed appWindow pointer (e.g., at appWindow->surfaceId, appWindow->width, appWindow->height), triggering the heap use-after-free, which causes a crash or, under favorable heap conditions, code execution (FreeRDP Advisory).

• Process: The FreeRDP X11 client process (xfreerdp) crashes unexpectedly, particularly when using RemoteApp mode (/app: flag) with GFX acceleration (/gfx).
• Logs: AddressSanitizer output (if compiled with ASan) showing heap-use-after-free in xf_AppUpdateWindowFromSurface at xf_window.c:1484; crash dumps referencing gdi_EndFrame, gdi_UpdateSurfaces, or rdpgfx_recv_end_frame_pdu in the stack trace.
• Network: Unusual RDP connections to unknown or untrusted servers; high-frequency DRDYNVC channel traffic (GFX EndFrame PDUs) followed immediately by fastpath window-delete orders from the server.
• File System: Core dump files generated by the xfreerdp process in the working directory or /var/crash/.

Upgrade FreeRDP to version 3.23.0 or later, which introduces hash table locking in xf_rail_get_window and a paired xf_rail_return_window function to prevent concurrent access to freed window objects (FreeRDP Commit). As a workaround until patching is complete, restrict FreeRDP client connections to trusted RDP servers only, and avoid using RemoteApp mode (/app:) with GFX acceleration (/gfx) when connecting to untrusted servers. Implement network segmentation to limit exposure of RDP client systems to potentially malicious servers. Linux distribution packages (Fedora, Ubuntu, SUSE, Debian, Amazon Linux 2) have begun shipping updated packages; consult your distribution's security advisories for specific package versions.

The vulnerability was reported by researcher ehdgks0627 and published by FreeRDP maintainer akallabeth via GitHub Security Advisory GHSA-p6rq-rxpc-rh3p on February 25, 2026 (FreeRDP Advisory). Coverage appeared on Phoronix noting the FreeRDP 3.23.0 release, and security tracking sites including Tenable Nessus (multiple plugin IDs), Qualys, and VulDB added detection shortly after disclosure. Linux distribution security teams for Fedora, Ubuntu, SUSE, Debian, and Amazon Linux 2 issued advisories and updated packages in the weeks following disclosure.