CVE-2026-25954
FreeRDP is a free implementation of the Remote Desktop Protocol.
Published Feb 25, 2026 · updated Jun 17, 2026 · freerdp freerdp
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, dereferences a freed pointer because returns an unprotected pointer from the hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Feb 25, 2026 · NIST NVD
Detected
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, dereferences a freed pointer because returns an unprotected pointer from the hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.
Jun 17, 2026 · NIST NVD
Updated
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, dereferences a freed pointer because returns an unprotected pointer from the hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.
Affected
- cpe freerdp/freerdpversion unspecified
Sources
- NIST NVDVulnerability recordCVE-2026-25954
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, dereferences a freed pointer because returns an unprotected pointer from the hash table, and the main thread
nvd.nist.gov