{"id":"CVE-2026-25952","summary":"FreeRDP has heap-use-after-free in xf_SetWindowMinMaxInfo","details":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_SetWindowMinMaxInfo` dereferences a freed `xfAppWindow` pointer because `xf_rail_get_window` in `xf_rail_server_min_max_info` returns an unprotected pointer from the `railWindows` hash table, and the main thread can concurrently delete the window (via a window delete order) while the RAIL channel thread is still using the pointer. Version 3.23.0 fixes the issue.","aliases":["GHSA-cgqm-cwjg-7w9x"],"modified":"2026-08-18T18:38:45.218845Z","published":"2026-02-25T20:24:07.396Z","related":["ALSA-2026:16014","ALSA-2026:16019","ALSA-2026:16482","ALSA-2026:19358","SUSE-SU-2026:1632-1","SUSE-SU-2026:1633-1","SUSE-SU-2026:1634-1","SUSE-SU-2026:1635-1","SUSE-SU-2026:1640-1","SUSE-SU-2026:21436-1","openSUSE-SU-2026:10408-1","openSUSE-SU-2026:10611-1","openSUSE-SU-2026:20632-1","openSUSE-SU-2026:20657-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-416"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25952.json"},"references":[{"type":"WEB","url":"https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1167"},{"type":"WEB","url":"https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1174"},{"type":"WEB","url":"https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1178"},{"type":"WEB","url":"https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1230-L1238"},{"type":"WEB","url":"https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L643"},{"type":"WEB","url":"https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1111"},{"type":"WEB","url":"https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1128"},{"type":"WEB","url":"https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1394"},{"type":"WEB","url":"https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_window.c#L1428"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25952.json"},{"type":"ADVISORY","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cgqm-cwjg-7w9x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25952"},{"type":"FIX","url":"https://github.com/FreeRDP/FreeRDP/commit/1994e9844212a6dfe0ff12309fef520e888986b5"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/freerdp/freerdp","events":[{"introduced":"0"},{"fixed":"b933ae18d9ad2a1d73c610868fcc30eb61654070"},{"fixed":"1994e9844212a6dfe0ff12309fef520e888986b5"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"3.23.0"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*"}}],"versions":["3.5.1","3.5.0","3.4.0","3.3.0","3.2.0","3.1.0","3.0.0","3.0.0-rc0","3.0.0-beta4","3.0.0-beta3","3.0.0-beta2","3.0.0-beta1","2.0.0","2.0.0-rc4","2.0.0-rc3","2.0.0-rc2","2.0.0-rc1","2.0.0-rc0","2.0.0-beta1+android11","2.0.0-beta1+android10","1.2.0-beta1+android9","1.2.0-beta1+android7","1.1.0-beta+2013071101","1.1.0-beta1+ios4","1.1.0-beta1+android5","1.1.0-beta1+android4","1.1.0-beta1+ios3","1.1.0-beta1+ios2","1.1.0-beta1+android3","1.1.0-beta1+android2","1.1.0-beta1+ios1","1.1.0-beta1","1.0.1","1.0.0","1.0-beta5","1.0-beta4","1.0-beta2","1.0-beta1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-25952.json","vanir_signatures_modified":"2026-08-18T18:38:45Z","vanir_signatures":[{"id":"CVE-2026-25952-017924d9","signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5","target":{"file":"client/X11/xf_event.c","function":"xf_event_FocusIn"},"deprecated":false,"digest":{"function_hash":"75837091431541601740380331260091358148","length":513}},{"deprecated":false,"digest":{"function_hash":"22973731691484862972653496078683120928","length":3050},"id":"CVE-2026-25952-12f73a9f","signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5","target":{"file":"client/X11/xf_event.c","function":"xf_event_process"}},{"target":{"file":"client/X11/xf_window.c","function":"xf_AppWindowFromX11Window"},"deprecated":false,"digest":{"function_hash":"23200884935117665525377049537457058650","length":453},"id":"CVE-2026-25952-16844d5d","signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5"},{"deprecated":false,"digest":{"line_hashes":["44673252754752056707207287291659148122","68960096304915171709642711924066095224","112203422276409991341665843174931163158","287929655737443704867510933086786283503","136485949688349305491201824278643362230","65899939309582869623527256161074101563","5302634347044414798734493223824736900","204647710964931083942397673366739921509","102866755006462261539663683791426131355","320511176892895844202654366671958461192"],"threshold":0.9},"id":"CVE-2026-25952-1f716c5a","signature_type":"Line","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5","target":{"file":"client/X11/xf_graphics.c"}},{"deprecated":false,"digest":{"function_hash":"204295825869548836340241452797673502695","length":886},"id":"CVE-2026-25952-255387a6","signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5","target":{"file":"client/X11/xf_rail.c","function":"xf_rail_window_icon"}},{"signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5","target":{"file":"client/X11/xf_rail.c","function":"xf_rail_get_window"},"deprecated":false,"digest":{"function_hash":"281731135428023223362948923820949594821","length":179},"id":"CVE-2026-25952-324e0e0d","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"69400924494583286231215138004942292746","length":2251},"id":"CVE-2026-25952-389363f1","signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5","target":{"file":"client/X11/xf_event.c","function":"xf_event_PropertyNotify"}},{"target":{"file":"client/X11/xf_event.c","function":"xf_generic_ButtonEvent_"},"deprecated":false,"digest":{"function_hash":"266765011002614472888604417435064364988","length":1472},"id":"CVE-2026-25952-3f2bf117","signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5"},{"target":{"file":"client/X11/xf_rail.c","function":"xf_rail_server_local_move_size"},"deprecated":false,"digest":{"function_hash":"200188261524607825774297838101079840883","length":1999},"id":"CVE-2026-25952-40ff590a","signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5","target":{"file":"client/X11/xf_rail.h"},"deprecated":false,"digest":{"line_hashes":["226919538306740003565690342486162279561","251155835213179431702178645114047667052","314680457102360911193712648773395575478","207727511189290111637850477303547342401"],"threshold":0.9},"id":"CVE-2026-25952-5569ae0a"},{"id":"CVE-2026-25952-5a532e8d","signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5","target":{"file":"client/X11/xf_graphics.c","function":"xf_Pointer_get_window"},"deprecated":false,"digest":{"length":423,"function_hash":"324093026589464826599292129433268503378"}},{"deprecated":false,"digest":{"line_hashes":["314244460059056733953048378602504828637","182149786279931250698884564817390020147","96932440155253206636615370290979895906","315855352110099805353052910493683885304","297860274695320679705148421052269080683","248500041384610759500258656230912547899","33022763258294882018258984649940840640","119760258307694884713454554291995660765","178980942139261650059928223700616991726","46307607556846559298072881631321639083","225516755723121644138092005815444184540","142884467943271514874735125179914806799","89022989499393010022129417352940458650","205976167112500604988627798480653405059","207084124333456976809716014244968951230","101285319493404979185020738277123888499","200087521580019504678519124765649165236","336617139838008560452615679223493499599","179358929201564920887592241080335913546","284914613184670261180703495675846103787","187106011133650755446964032837763929108","15827093710187999023891671510502249252","243912350724904516526496485599169352692","33787159016585236036200416520097349530","323776909658798363433999052631404719003","291211799838988678957013018568412107332","38832024327886231875749886598002840874","291277135682931318147180137519994813256","164408806172928660649034432079265791332","37355179913163555034661935998724204422","218448127113415679216966050744983463203","197268446232866894735294384283330962735","282668036818301328704618932041094486216","15827093710187999023891671510502249252","243912350724904516526496485599169352692","33787159016585236036200416520097349530","329327805827823978467973349321255282442","29478054235938281245213960629722161698","289329691092166037621633851681340883640","40676159025883371986993765960870822620","323720684728727821014794572931999446619","31592913548634770728011873568283140093","185789966691577112503236520756585371434","164130101730139061253253419969749366887","158125137518758388114937375401545390452","47881951969597421123457796597277440030","102065666641645124249209730636502930329","301045459522769310820627867277560964181"],"threshold":0.9},"id":"CVE-2026-25952-6191cd4e","signature_type":"Line","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5","target":{"file":"client/X11/xf_rail.c"}},{"signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5","target":{"file":"client/X11/xf_window.h"},"deprecated":false,"digest":{"line_hashes":["229189004214700062739512292114659193685","251760257960158531626835841419025064286","107429319597352126187062181214386832628","210788495062329298101406564644293664583"],"threshold":0.9},"id":"CVE-2026-25952-64c9e866","signature_type":"Line"},{"target":{"file":"client/X11/xf_event.c","function":"xf_event_MapNotify"},"deprecated":false,"digest":{"function_hash":"178925766441469339411944227582274747127","length":287},"id":"CVE-2026-25952-72c65040","signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5"},{"deprecated":false,"digest":{"function_hash":"78790820364576145761685872528230989776","length":437},"id":"CVE-2026-25952-8b247f02","signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5","target":{"file":"client/X11/xf_event.c","function":"xf_event_ClientMessage"}},{"target":{"file":"client/X11/xf_rail.c","function":"xf_rail_server_min_max_info"},"deprecated":false,"digest":{"function_hash":"130106076230108205809210995131259296506","length":448},"id":"CVE-2026-25952-950b69a3","signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["109938019600704347933353324734647267182","208236195258375533333151423508801408170","169100885811334821926027612628032928614","97720161735645922729014100177939915912","339748501656917803867555038344455439722","262685611587175159443457401620197191472","100826930096020411002273823518300986444","309284812112128396781603878612030243846","122300329447619617625658241378743313680","45393429958987014060637276971128531606","67274351715292177402894163217968672867","145711955325202161207351981930436098001","253582338782778065112043807607971892585","94961324942242581340341737885658487184","336842993116974378556457463387466002004","303572181237658098601572305184389164048","119393301694049453040440815765344083479","108394429480729108641155054118833607364","206340244611780401015762028485650475937","206397693253899801195800589431292027007","271313428045300393965296506107012261809","127043214434878497795137657514039363312"]},"id":"CVE-2026-25952-95eac0ae","signature_type":"Line","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5","target":{"file":"client/X11/xf_window.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5","target":{"file":"client/X11/xf_window.c","function":"xf_AppUpdateWindowFromSurface"},"deprecated":false,"digest":{"function_hash":"45219925652229067446348718489840589365","length":2121},"id":"CVE-2026-25952-aa69c52b"},{"digest":{"function_hash":"263654978323021991949199072151025027004","length":915},"id":"CVE-2026-25952-b7024f3b","signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5","target":{"file":"client/X11/xf_event.c","function":"xf_generic_MotionNotify_"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5","target":{"file":"client/X11/xf_event.c","function":"xf_event_EnterNotify"},"deprecated":false,"digest":{"function_hash":"87608716134825076747642785769015989811","length":434},"id":"CVE-2026-25952-cbafc6bf"},{"id":"CVE-2026-25952-de4730cc","signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5","target":{"function":"xf_rail_paint_surface","file":"client/X11/xf_rail.c"},"deprecated":false,"digest":{"function_hash":"298115818439167927602235944779367289479","length":1034}},{"id":"CVE-2026-25952-e4526239","signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5","target":{"file":"client/X11/xf_event.c","function":"xf_event_UnmapNotify"},"deprecated":false,"digest":{"length":340,"function_hash":"295196610994003079758328911245876743540"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5","target":{"file":"client/X11/xf_rail.c","function":"xf_rail_send_activate"},"deprecated":false,"digest":{"function_hash":"168352026439176294489774536499499827384","length":397},"id":"CVE-2026-25952-e743c22d"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5","target":{"file":"client/X11/xf_event.c"},"deprecated":false,"digest":{"line_hashes":["260239918427052148937414284090451044794","181015808665536195148456594979616356279","290925896583534694601752304222148630229","264763975542750029625084600565222211245","136262975178112812573410381558835383335","181015808665536195148456594979616356279","17511994865893495393311866571415537494","264763975542750029625084600565222211245","83031112826900185457698744815246722964","124008181315498986139877066872612056116","245553934032943671337652567928306145500","216891618838784046732011212710910230095","246598946299062751996918415336877603276","139678862652051853313634343949535968728","180071069969730910124531170851274102242","126931302297120663633616480414361271218","40748461832853791263784211711986093771","109229349104694696503986641746570897389","131457338739179732873551599790384053838","279037000907220776805611731364216240746","280587232732650678785924321879187743110","299061175993701942198024163538140296675","309903823016104765096687453816896324911","107748498684136312259978204257507424903","186061529073450775632976479893495194322","263010684443426162867165993591138687809","140505237705740234257460918735422111036","130057574374784928490921186869079612229","74981900291928099756501764316536564514","53598107304935456723172842383701054521","78814811171026847283074873282993123387","161078659567847640820436682880138261217","252887400529574292626266155114249439144","199517928564442643338835757142561244881","2332034561737088077423950358427776492","63023319149774050960125992398873200987","331110472572483874120045135043000840957","163577270280717700012261543036491788055","294878490301817193654524479350241520264","226321398110708121878178987022518402835","123290613589404069118931614723184114869","147794273560154867071961221344743640439","15644662961233804202564373218720061415","12929708016380719032269009265648975834","53762541811133422175088257516861739618","276924060784929863436813550129021671525","333665177027783029537035224209088695172","277575409288601477170770598924639328667","217514894282575070001499137481261330213","339686446211889114775084454062983354324","277871715204890944849270898918765713741","192301477657426368376082063029024890514","281744816872314703379992372183793936050","210771769538906044388440192813640596011","142604019225729826816532863877772206370","30740980557203566963381005758862307746","24559136452625343955934870385455685482","123260134160298831349625236935017912232","147632274620324077042487904732842608301","163400421679659989194856942476303804236","177195388512543586191901903504376627405","115297947155202044217651398397439755647","35487060983812109706536535958099993777","141539780723801666483975159601686647948","327650864840262155846421520973750755599","8810559010630627487303649031299700487","145228288505908013240046824273557557425","181105449984066219016522275788870868932","194904293442386071979202039909949222711","229927805238642415270532402153913183941","86797936907190064028668498472671018938","101071543047490151532673918909803138347","199547109875554066229643125835039381497","308494887924298405265249603702320333321","278720669317588318825395133154223446348","281344896985228061869961869829726506441","207171420579102811627725599645121195210","295349130815150717614251480828725260481"],"threshold":0.9},"id":"CVE-2026-25952-ecbf4216"},{"source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5","target":{"file":"client/X11/xf_event.c","function":"xf_event_LeaveNotify"},"deprecated":false,"digest":{"function_hash":"159152595824656439334618811792800004516","length":383},"id":"CVE-2026-25952-f8d74d04","signature_type":"Function","signature_version":"v1"},{"digest":{"length":712,"function_hash":"172750151809165435386777107242205562177"},"id":"CVE-2026-25952-fb7f5bbf","signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5","target":{"file":"client/X11/xf_rail.c","function":"xf_rail_window_cached_icon"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"123064250889863563138005263344954301961","length":311},"id":"CVE-2026-25952-ff481fdf","signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5","target":{"file":"client/X11/xf_window.c","function":"xf_XSetTransientForHint"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/1994e9844212a6dfe0ff12309fef520e888986b5","target":{"file":"client/X11/xf_event.c","function":"xf_event_ConfigureNotify"},"deprecated":false,"digest":{"function_hash":"26507239305519702796563545062970228517","length":2192},"id":"CVE-2026-25952-ff6cc165"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}]}