CVE-2026-25959: 
NixOS vulnerability analysis and mitigation

CVE-2026-25959 is a heap use-after-free vulnerability in FreeRDP's X11 clipboard redirection handler (xf_cliprdr_provide_data_). It affects all FreeRDP versions prior to 3.23.0 and was disclosed on February 25, 2026, by researcher ehdgks0627 via a GitHub Security Advisory. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) per NVD, though the authoritative CVSS v4.0 score assigned by GitHub is 5.5 (Medium), reflecting more constrained practical impact (GitHub Advisory, Red Hat CVE).

The root cause is a race condition (CWE-416: Use After Free; CWE-825: Expired Pointer Dereference) between two threads in the FreeRDP X11 client. The cliprdr channel thread calls xf_cliprdr_server_format_data_response, which allocates pDstData via ClipboardGetData, inserts it into clipboard->cachedData via HashTable_Insert, and then passes the same pointer to xf_cliprdr_provide_data_ → XChangeProperty — all without holding any lock. Concurrently, the X11 event thread can call xf_cliprdr_send_format_list → xf_cliprdr_clear_cached_data → HashTable_Clear, which frees all cached entries including pDstData via xf_cached_data_free. This causes XChangeProperty to perform a memcpy on the freed heap region. The fix (commit d3e8b3b) adds HashTable_Lock/HashTable_Unlock around the cache lookup and data provision sequence in xf_cliprdr_process_selection_request (GitHub Advisory, Fix Commit).

A malicious RDP server can trigger a client-side heap use-after-free during clipboard operations, causing the FreeRDP client to crash (denial of service). Depending on heap allocator behavior and surrounding memory layout, the corruption could theoretically escalate to arbitrary code execution on the connecting client machine, though practical exploitation beyond DoS has not been demonstrated. The vulnerability affects only the X11 client (Linux/Unix desktop environments using xfreerdp with clipboard redirection enabled); Windows and other platform clients are not affected (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, including a detailed reproduction procedure using AddressSanitizer. Exploitation requires no authentication and no user interaction — a malicious RDP server can trigger the race condition by responding to CB_FORMAT_DATA_REQUEST with clipboard data while the client concurrently processes clipboard ownership changes. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.066% (low probability of near-term exploitation). The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Red Hat CVE).

1. Set up a malicious RDP server: Deploy a custom RDP server (e.g., using a modified FreeRDP server or a scripted implementation) that supports the clipboard redirection (cliprdr) virtual channel and responds to CB_FORMAT_DATA_REQUEST with dummy UTF-16LE clipboard data, then disconnects after a short interval to trigger auto-reconnect.
2. Lure the victim to connect: Induce a target user running xfreerdp (version ≤ 3.22.0 on Linux/X11) to connect to the malicious server with clipboard and auto-reconnect enabled: xfreerdp /v:<attacker_ip>:<port> /u:a /p:a /cert:ignore +clipboard +auto-reconnect /auto-reconnect-max-retries:20.
3. Trigger concurrent clipboard activity: While the RDP session is active, the malicious server repeatedly sends CB_FORMAT_DATA_RESPONSE messages. Simultaneously, clipboard ownership changes on the X11 side (e.g., via rapid clipboard writes/reads using xclip) cause the X11 event thread to call xf_cliprdr_clear_cached_data → HashTable_Clear.
4. Race condition triggers UAF: The cliprdr channel thread uses pDstData in XChangeProperty after the X11 thread has freed it via HashTable_Clear, triggering a heap use-after-free. Under AddressSanitizer this is detected as a READ in memcpy inside XChangeProperty on freed memory.
5. Achieve DoS or potential code execution: The client process crashes (DoS). With a carefully crafted heap layout and allocator timing, an attacker could potentially achieve code execution on the client system, though this has not been publicly demonstrated (GitHub Advisory).

• Process: Unexpected crash or abort of the xfreerdp process, particularly during active clipboard operations in an RDP session; AddressSanitizer output showing heap-use-after-free in memcpy called from XChangeProperty → xf_cliprdr_provide_data_ → xf_cliprdr_server_format_data_response.
• Logs: System crash reports or core dumps from the xfreerdp binary; application logs showing repeated RDP reconnection attempts followed by abrupt termination; FreeRDP debug logs (if enabled) showing rapid CB_FORMAT_DATA_RESPONSE processing interleaved with xf_cliprdr_clear_cached_data calls.
• Network: Unusual RDP traffic patterns from an unexpected server IP, particularly repeated CB_FORMAT_DATA_RESPONSE messages at high frequency; RDP connections to non-standard ports or unrecognized server certificates accepted via /cert:ignore.

Upgrade FreeRDP to version 3.23.0 or later, which contains the fix (commit d3e8b3b) that adds proper locking around the clipboard cache access in xf_cliprdr_process_selection_request. Linux distributions including Fedora, Ubuntu, SUSE, and Debian have issued updated packages. If immediate patching is not possible: disable clipboard redirection by omitting the +clipboard flag when launching xfreerdp; restrict network access so users only connect to trusted RDP servers; and monitor for xfreerdp crashes during clipboard use (GitHub Advisory, Fix Commit, Red Hat CVE).

The vulnerability was reported by researcher ehdgks0627 and published by FreeRDP maintainer akallabeth via GitHub Security Advisory on February 25, 2026. Coverage appeared on Phoronix in the context of the FreeRDP 3.23 release, and the vulnerability was picked up by Linux security news aggregators including LinuxSecurity.com (Ubuntu and SUSE advisories), pro-linux.de, and linuxcompatible.org. No significant controversy or broad social media discussion was observed; community response was focused on downstream package updates across major Linux distributions (GitHub Advisory).