CVE-2026-25955: 
NixOS vulnerability analysis and mitigation

CVE-2026-25955 is a heap use-after-free vulnerability in FreeRDP's X11 client affecting all versions prior to 3.23.0. The flaw resides in the xf_AppUpdateWindowFromSurface function, which reuses a cached XImage whose data pointer references a freed RDPGFX surface buffer after gdi_DeleteSurface releases surface->data without invalidating the aliasing appWindow->image. The vulnerability was disclosed on February 25, 2026, and fixed in version 3.23.0. It carries a CVSS v3.1 base score of 9.8 (Critical) per NVD, though the CVSS v4.0 score is 5.5 (Medium) reflecting more nuanced impact modeling (GitHub Advisory).

The root cause is a CWE-416 (Use After Free) condition in client/X11/xf_window.c. When a RAIL window receives its first RDPGFX surface paint with SoftwareGdi=TRUE, xf_AppUpdateWindowFromSurface creates an XImage via XCreateImage that directly aliases surface->data (no copy) and caches it in appWindow->image. When the server sends a DeleteSurface PDU, gdi_DeleteSurface frees surface->data via winpr_aligned_free() but does not notify the X11 layer to invalidate appWindow->image. If the server subsequently creates a new surface with the same surfaceId and matching dimensions, the stale appWindow->image is reused (the dimension/ID check passes), and XPutImage is called with a data pointer referencing freed heap memory. A malicious RDP server can orchestrate this sequence — CreateSurface → MapSurfaceToWindow → paint → DeleteSurface → CreateSurface (same ID/dimensions) → paint — to trigger the use-after-free (GitHub Advisory, Fix Commit).

Successful exploitation by a malicious RDP server causes a client-side heap use-after-free, which can result in a crash (denial of service) or, depending on heap allocator behavior and surrounding heap layout, potential heap corruption enabling arbitrary code execution or information disclosure. The vulnerability affects the confidentiality, integrity, and availability of the FreeRDP client process. Because exploitation is triggered entirely by server-sent RDP protocol messages, any user connecting to an untrusted or attacker-controlled RDP server with RAIL and RDPGFX support is at risk (GitHub Advisory).

A proof-of-concept exploit sequence is publicly documented in the GitHub Security Advisory, including the precise RDPGFX PDU sequence and an AddressSanitizer trace confirming the heap-use-after-free. No authentication or user interaction is required — the attacker only needs the victim to connect to a malicious RDP server. The EPSS score is approximately 0.05% (0.0005), indicating low current exploitation probability. There is no evidence of in-the-wild exploitation as of the time of disclosure, and the vulnerability is not listed in the CISA KEV catalog. The CVSSv4 exploit maturity is rated as Proof-of-Concept (GitHub Advisory).

1. Set up a malicious RDP server: Configure a server that advertises RAIL (Remote Application Integrated Locally) and RDPGFX dynamic channel support, capable of sending crafted RDPGFX PDUs.
2. Lure the victim to connect: Trick an xfreerdp client (version < 3.23.0) into connecting with options /gdi:sw /gfx /app:program:<appname> to enable software GDI and RDPGFX in remote app mode.
3. Trigger initial surface creation and paint: Server sends CreateSurface(surfaceId=1, 400x320) → MapSurfaceToWindow(surfaceId=1, windowId) → StartFrame → SolidFill(surfaceId=1) → EndFrame. The client processes the paint and caches an XImage referencing surface->data.
4. Delete the surface to free the buffer: Server sends DeleteSurface(surfaceId=1). The client calls gdi_DeleteSurface, which frees surface->data via winpr_aligned_free(), but appWindow->image->data still points to the freed buffer.
5. Re-create the surface with the same ID and dimensions: Server sends CreateSurface(surfaceId=1, 400x320) (identical ID and dimensions) → MapSurfaceToWindow → StartFrame → SolidFill → EndFrame.
6. Trigger use-after-free: The client's xf_AppUpdateWindowFromSurface skips image recreation (ID and dimensions match) and calls XPutImage with the stale XImage, reading from freed heap memory — causing a crash or potential code execution (GitHub Advisory).

• Process: The xfreerdp client process crashes unexpectedly or exits with a segmentation fault or abort signal during a remote app (RAIL) session.
• Logs: AddressSanitizer output (if enabled) showing heap-use-after-free in xf_AppUpdateWindowFromSurface at xf_window.c:1528; crash dumps referencing XPutImage called from xf_AppUpdateWindowFromSurface.
• Network: RDP traffic to an unexpected or untrusted server IP on port 3389 (or custom RDP port) with RDPGFX dynamic channel activity; repeated CreateSurface/DeleteSurface/CreateSurface PDU sequences with the same surface ID in a short time window.
• File System: Core dump files generated by the xfreerdp process in the working directory or /var/crash/ following an unexpected termination during a RAIL session (GitHub Advisory).

Upgrade FreeRDP to version 3.23.0 or later, which fixes the issue by registering an xf_UnmapWindowForSurface callback that calls xf_AppWindowDestroyImage to invalidate the cached XImage when a surface is deleted (Fix Commit). Downstream distributions including Fedora, Ubuntu, SUSE/openSUSE, and Debian have released updated packages. As a workaround where patching is not immediately possible, avoid connecting to untrusted or unknown RDP servers using the RAIL (/app) and RDPGFX (/gfx) modes together, or disable software GDI (/gdi:sw) to prevent the vulnerable code path from being triggered (GitHub Advisory).

The vulnerability was reported by researcher ehdgks0627 and published by FreeRDP maintainer akallabeth via GitHub Security Advisories on February 25, 2026. The advisory was rated "Moderate" severity by the FreeRDP project despite the high CVSS v3.1 score, reflecting the client-side nature and specific preconditions required. Coverage appeared on Phoronix (FreeRDP 3.23 release notes), pro-linux.de, and Linux security aggregators including linuxsecurity.com and linuxcompatible.org. No significant threat actor attribution or broader media controversy has been observed (GitHub Advisory).