CVE-2026-25997: 
NixOS vulnerability analysis and mitigation

CVE-2026-25997 is a heap use-after-free vulnerability in FreeRDP's X11 clipboard handling code (xf_clipboard_format_equal in client/X11/xf_cliprdr.c). It affects all FreeRDP releases prior to version 3.23.0 and was disclosed on February 25, 2026. The flaw arises from a race condition between two threads during auto-reconnect: the cliprdr channel thread frees the lastSentFormats array while the X11 event thread concurrently reads it. It carries a CVSS v3.1 base score of 9.8 (Critical) per Red Hat's assessment, though the CVSS v4.0 base score is 5.5 (Medium) reflecting more constrained real-world impact (FreeRDP Advisory, Red Hat CVE).

The root cause is a missing synchronization lock (CWE-416: Use After Free; CWE-825: Expired Pointer Dereference) in xf_cliprdr_monitor_ready. During auto-reconnect, the cliprdr channel thread calls xf_clipboard_formats_free → xf_cliprdr_free_formats, which calls free(formats) on clipboard->lastSentFormats. However, clipboard->lastSentFormats and clipboard->lastSentNumFormats are only zeroed after free() returns, leaving a dangling pointer window. Simultaneously, the X11 event thread — which continues polling because clipboard->sync remains TRUE from the previous session — can enter xf_clipboard_changed and iterate clipboard->lastSentFormats[x], calling xf_clipboard_format_equal on freed memory. The fix (commit 5840940) wraps the xf_clipboard_formats_free call in xf_lock_x11/xf_unlock_x11 to serialize access between the two threads (FreeRDP Advisory, Fix Commit).

Successful exploitation causes a heap use-after-free in the FreeRDP client process, leading to a crash (denial of service). Depending on heap allocator behavior and surrounding heap layout, the condition may also enable heap corruption with potential code-execution risk, though this has not been demonstrated in practice. The vulnerability is client-side only — a malicious or compromised RDP server can trigger the condition by disconnecting and forcing the client's auto-reconnect path while clipboard ownership changes are occurring on the client's X11 display (FreeRDP Advisory).

A proof-of-concept (PoC) is publicly available in the FreeRDP security advisory, demonstrating the issue using AddressSanitizer-instrumented builds with a sample RDP server that disconnects after 3 seconds to trigger auto-reconnect while clipboard ownership is spammed via xclip. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.066%, indicating low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (FreeRDP Advisory, Red Hat CVE).

1. Set up a malicious/controlled RDP server: Configure an RDP server with clipboard redirection (cliprdr) support that is programmed to disconnect the client after a short period (e.g., 3 seconds) to trigger the client's auto-reconnect path.
2. Connect a vulnerable FreeRDP client: Have the target connect using xfreerdp /v:<server>:<port> /u:<user> /p:<pass> /cert:ignore +clipboard +auto-reconnect /auto-reconnect-max-retries:20 from an X11 session running FreeRDP < 3.23.0.
3. Spam clipboard ownership changes: On the client's X11 display, concurrently and rapidly change clipboard ownership (e.g., while true; do echo "data" | xclip -selection clipboard; sleep 0.01; done) to keep the X11 event thread actively iterating lastSentFormats via xf_clipboard_changed.
4. Trigger the race condition: When the server disconnects and the client auto-reconnects, the cliprdr channel thread calls xf_clipboard_formats_free (freeing lastSentFormats) while the X11 event thread concurrently reads the now-freed array in xf_clipboard_format_equal, triggering the heap use-after-free.
5. Achieve DoS or potential heap corruption: The freed memory access causes a crash (DoS). Depending on allocator behavior and heap layout, further exploitation for code execution may be possible (FreeRDP Advisory).

• Process: FreeRDP client (xfreerdp) process crashes unexpectedly, particularly during or shortly after an auto-reconnect event while clipboard is active.
• Logs: AddressSanitizer output (if enabled) showing heap-use-after-free in xf_clipboard_format_equal at client/X11/xf_cliprdr.c:831; application crash logs or core dumps from the xfreerdp process.
• Process behavior: Repeated xfreerdp process terminations correlated with RDP server disconnections and active clipboard usage on the client's X11 session.
• Network: Unusual or repeated RDP disconnection/reconnection cycles from the same server to a client, potentially indicating a server-side trigger attempt.

Upgrade FreeRDP to version 3.23.0 or later, which fixes the race condition by wrapping the xf_clipboard_formats_free call in xf_lock_x11/xf_unlock_x11 in xf_cliprdr_monitor_ready (commit 5840940). Downstream distributions including Red Hat (RHSA-2026:16014), Rocky Linux, Oracle Linux, Ubuntu, Debian, SUSE/openSUSE, Amazon Linux 2, and Fedora have issued updated packages. As a temporary workaround, disabling clipboard redirection (-clipboard flag) when connecting with xfreerdp eliminates the vulnerable code path entirely (FreeRDP Advisory, Fix Commit, Red Hat Errata).

The vulnerability was reported by security researcher ehdgks0627 and published by FreeRDP maintainer akallabeth on February 25, 2026. Coverage appeared across Linux security news outlets including Phoronix (noting the FreeRDP 3.23 release), Pro-Linux, and LinuxCompatible, as well as vulnerability aggregators. Community reaction has been routine — the issue is treated as a moderate client-side bug requiring a patch update rather than an emergency, consistent with its limited real-world exploitability (FreeRDP Advisory).