CVE-2026-25954: 
NixOS vulnerability analysis and mitigation

CVE-2026-25954 is a heap use-after-free vulnerability in FreeRDP's X11 RAIL (Remote Application Integrated Locally) implementation, specifically in the xf_rail_server_local_move_size function. The flaw affects all FreeRDP versions prior to 3.23.0 and was disclosed on February 25, 2026, with a fix released in version 3.23.0. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is a classic race condition leading to a use-after-free (CWE-416) in client/X11/xf_rail.c. The xf_rail_server_local_move_size function, running on the RAIL SVC channel thread (T6), calls xf_rail_get_window to retrieve an xfAppWindow pointer from the railWindows hash table. The hash table lock is released immediately after the lookup, leaving the returned pointer without a lifetime guarantee. Concurrently, the main thread (T2) can process a window delete order, triggering xf_rail_window_delete → xf_rail_del_window → HashTable_Remove, which calls the value destructor rail_window_free → xf_DestroyWindow, freeing the appWindow struct. When the RAIL channel thread subsequently dereferences appWindow->handle (e.g., in XTranslateCoordinates), the memory has already been freed, resulting in a heap-use-after-free. The fix (commit 1994e98) introduces a xf_rail_return_window function and holds the hash table lock for the entire duration of appWindow usage (GitHub Advisory, Fix Commit).

Successful exploitation by a malicious RDP server causes a client-side crash (denial of service) by corrupting heap memory. The primary impact is availability — the FreeRDP client process terminates, disrupting active remote desktop sessions. Depending on allocator behavior and surrounding heap layout, the advisory notes a potential for heap corruption with code-execution risk, though no code execution has been demonstrated in practice (GitHub Advisory).

A proof-of-concept (PoC) demonstrating the crash via AddressSanitizer output is publicly available in the GitHub security advisory. The PoC requires controlling or simulating a RAIL-capable RDP server that rapidly alternates between sending ServerLocalMoveSize PDUs and window delete orders. No authentication or user interaction is required — the attack is network-reachable and fully automated. The EPSS score is approximately 0.049% (very low), and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing as of the time of this report (GitHub Advisory).

1. Set up a malicious RAIL-capable RDP server: Configure or implement an RDP server that supports the RAIL (RemoteApp) extension and can send arbitrary RAIL protocol PDUs, including ServerLocalMoveSize and window delete orders.
2. Establish a client connection: Lure or wait for a victim running a vulnerable FreeRDP client (version ≤ 3.22.0) to connect using a command such as xfreerdp /v:<attacker-ip>:<port> /u:a /p:a /cert:ignore /app:program:notepad.exe.
3. Send window create order: Issue a RAIL window create order to the client, causing it to allocate an xfAppWindow struct and register it in the railWindows hash table.
4. Race the threads: Rapidly and repeatedly alternate between sending RAIL ServerLocalMoveSize PDUs (via the SVC channel, processed by the RAIL channel thread T6) and window delete orders (via the update stream, processed by the main thread T2).
5. Trigger the race condition: The RAIL channel thread calls xf_rail_get_window, obtains the appWindow pointer, and releases the hash table lock. Simultaneously, the main thread processes the window delete order, freeing the appWindow struct via HashTable_Remove → rail_window_free → xf_DestroyWindow.
6. Achieve heap-use-after-free: The RAIL channel thread dereferences the freed appWindow->handle in XTranslateCoordinates, causing a crash (DoS) and potential heap corruption (GitHub Advisory).

• Process: Unexpected crash or abort of the xfreerdp client process, particularly when using RemoteApp (/app:) mode against an untrusted server.
• Logs: AddressSanitizer output (if enabled) showing heap-use-after-free in xf_rail_server_local_move_size at xf_rail.c:1133; crash dumps referencing XTranslateCoordinates called from the RAIL channel thread (T6) with a freed pointer.
• Network: Unusual RDP traffic patterns where a server rapidly alternates between RAIL ServerLocalMoveSize PDUs and window delete orders in quick succession.
• File System: Core dump files (core.*) generated by the xfreerdp process in the working directory or /var/crash/ following an unexpected termination (GitHub Advisory).

Upgrade FreeRDP to version 3.23.0 or later, which contains the fix (commit 1994e98) that holds the railWindows hash table lock for the entire duration of appWindow usage via the new xf_rail_return_window function. If immediate patching is not possible, restrict FreeRDP client connections to trusted RDP servers only, and avoid using RemoteApp (/app:) mode against untrusted endpoints. Network segmentation to limit exposure to untrusted RDP servers is an additional interim control. Downstream distributions including Fedora, Ubuntu, SUSE, openSUSE, Debian, and Amazon Linux 2 have released updated packages (GitHub Advisory, Fix Commit).

The vulnerability was reported by security researcher ehdgks0627 and published by FreeRDP maintainer akallabeth via GitHub's security advisory system on February 25, 2026. Coverage appeared across Linux security news outlets including Phoronix (noting the FreeRDP 3.23 release), pro-linux.de, and linuxsecurity.com, as well as automated CVE tracking feeds. No significant broader media coverage or notable threat actor commentary has been observed (GitHub Advisory).