Every CVE Search/ Get API key

CVE-2026-25959

FreeRDP has heap-use-after-free in xf_cliprdr_provide_data_

5.5 MediumFix available

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xf_cliprdr_provide_data_ passes freed pDstData to XChangeProperty because the cliprdr channel thread calls xf_cliprdr_server_format_data_response which converts and uses the clipboard data without holding any lock, while the X11 event thread concurrently calls xf_cliprdr_clear_cached_data → HashTable_Clear which frees the same data via xf_cached_data_free, triggering a heap use after free. Version 3.23.0 fixes the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.65%Up 0.6 points since Feb 26, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.5

FreeRDP has heap-use-after-free in xf_cliprdr_provide_data_

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xf_cliprdr_provide_data_ passes freed pDstData to XChangeProperty because the cliprdr channel thread calls xf_cliprdr_server_format_data_response which converts and uses the clipboard data without holding any lock, while the X11 event thread concurrently calls xf_cliprdr_clear_cached_data → HashTable_Clear which frees the same data via xf_cached_data_free, triggering a heap use after free. Version 3.23.0 fixes the issue.

Record
CVE-2026-25959
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2026-8736 5.5

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xf_cliprdr_provide_data_ passes freed pDstData to XChangeProperty because the cliprdr channel thread calls xf_cliprdr_server_format_data_response which converts and uses the clipboard data without holding any lock, while the X11 event thread concurrently calls xf_cliprdr_clear_cached_data → HashTable_Clear which frees the same data via xf_cached_data_free, triggering a heap use after free. Version 3.23.0 fixes the issue.

Record
EUVD-2026-8736
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
NVD 5.5

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xf_cliprdr_provide_data_ passes freed pDstData to XChangeProperty because the cliprdr channel thread calls xf_cliprdr_server_format_data_response which converts and uses the clipboard data without holding any lock, while the X11 event thread concurrently calls xf_cliprdr_clear_cached_data → HashTable_Clear which frees the same data via xf_cached_data_free, triggering a heap use after free. Version 3.23.0 fixes the issue.

Record
CVE-2026-25959
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
OSVALPINE-CVE-2026-25959 9.8

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xf_cliprdr_provide_data_ passes freed pDstData to XChangeProperty because the cliprdr channel thread calls xf_cliprdr_server_format_data_response which converts and uses the clipboard data without holding any lock, while the X11 event thread concurrently calls xf_cliprdr_clear_cached_data → HashTable_Clear which frees the same data via xf_cached_data_free, triggering a heap use after free. Version 3.23.0 fixes the issue.

Record
ALPINE-CVE-2026-25959
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSV 5.5

FreeRDP has heap-use-after-free in xf_cliprdr_provide_data_

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xf_cliprdr_provide_data_ passes freed pDstData to XChangeProperty because the cliprdr channel thread calls xf_cliprdr_server_format_data_response which converts and uses the clipboard data without holding any lock, while the X11 event thread concurrently calls xf_cliprdr_clear_cached_data → HashTable_Clear which frees the same data via xf_cached_data_free, triggering a heap use after free. Version 3.23.0 fixes the issue.

Record
CVE-2026-25959
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-416
Updated
2026-11-02
OSVDEBIAN-CVE-2026-25959 9.8

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xf_cliprdr_provide_data_ passes freed pDstData to XChangeProperty because the cliprdr channel thread calls xf_cliprdr_server_format_data_response which converts and uses the clipboard data without holding any lock, while the X11 event thread concurrently calls xf_cliprdr_clear_cached_data → HashTable_Clear which frees the same data via xf_cached_data_free, triggering a heap use after free. Version 3.23.0 fixes the issue.

Record
DEBIAN-CVE-2026-25959
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVUBUNTU-CVE-2026-25959 5.5

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xf_cliprdr_provide_data_ passes freed pDstData to XChangeProperty because the cliprdr channel thread calls xf_cliprdr_server_format_data_response which converts and uses the clipboard data without holding any lock, while the X11 event thread concurrently calls xf_cliprdr_clear_cached_data → HashTable_Clear which frees the same data via xf_cached_data_free, triggering a heap use after free. Version 3.23.0 fixes the issue.

Record
UBUNTU-CVE-2026-25959
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2026-0383 No score

Updated freerdp packages fix security vulnerabilities

Updated packages bring lot of security fixes. Please see the links for additional information.

Record
MGASA-2026-0383
Updated
2026-11-02
OSVopenSUSE-SU-2026:10408-1 No score

freerdp-3.24.1-1.1 on GA media

These are all security issues fixed in the freerdp-3.24.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10408-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20657-1 No score

Security update for freerdp

This update for freerdp fixes the following issues:

Update to version 3.24.2.

Security issues fixed:

  • CVE-2026-25941: out-of-bounds read in the FreeRDP client RDPGFX channel (bsc#1258919).
  • CVE-2026-25942: buffer overflow of global array in xf_rail_server_execute_result (bsc#1258920).
  • CVE-2026-25952: heap use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
  • CVE-2026-25953: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
  • CVE-2026-25954: heap use-after-free in xf_rail_server_local_move_size (bsc#1258924).
  • CVE-2026-25955: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258973).
  • CVE-2026-25959: heap use-after-free in xf_cliprdr_provide_data_ (bsc#1258976).
  • CVE-2026-25997: heap use-after-free in xf_clipboard_format_equal (bsc#1258977).
  • CVE-2026-26271: buffer overread in FreeRDP icon processing (bsc#1258979).
  • CVE-2026-26955: out-of-bounds write in FreeRDP clients using the GDI surface pipeline (bsc#1258982).
  • CVE-2026-26965: out-of-bounds write in FreeRDP client RLE planar decode path (bsc#1258985).
  • CVE-2026-29774: heap buffer overflow in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path (bsc#1259689).
  • CVE-2026-29775: out-of-bounds access in the FreeRDP client bitmap cache subsystem (bsc#1259684).
  • CVE-2026-29776: integer underflow in update_read_cache_bitmap_order (bsc#1259692).
  • CVE-2026-31806: heap buffer overflow in nsc_process_message (bsc#1259653).
  • CVE-2026-31883: heap buffer overwrite due to a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders (bsc#1259679).
  • CVE-2026-31884: division by zero in MS-ADPCM and IMA-ADPCM decoders (bsc#1259680).
  • CVE-2026-31885: out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders (bsc#1259686).
  • CVE-2026-31897: out-of-bounds read in freerdp_bitmap_decompress_planar (bsc#1259693).
  • CVE-2026-33952: client-side crash due to WINPR_ASSERT() failure in rts_read_auth_verifier_no_checks() (bsc#1261196).
  • CVE-2026-33977: client-side crash due to WINPR_ASSERT() failure in IMA ADPCM audio decoder (bsc#1261198).
  • CVE-2026-33982: heap buffer overread in in winpr_aligned_offset_recalloc (bsc#1261222).
  • CVE-2026-33983: undefined behavior and resource exhaustion via 80 billion iteration loop in progressive_decompress_tile_upgrade (bsc#1261200).
  • CVE-2026-33984: heap buffer overflow in ClearCodec resize_vbar_entry (bsc#1261211).
  • CVE-2026-33985: heap out-of-bounds read in clear_decompress_glyph_data (bsc#1261217).
  • CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).
  • CVE-2026-33987: heap out-of-bounds write due to persistent cache bmpSize desync (bsc#1261226).
  • CVE-2026-33995: double-free vulnerability in kerberos_AcceptSecurityContext and kerberos_InitializeSecurityContextA (bsc#1261227).

Other updates and bugfixes:

  • Version 3.24.2:

    • [channels,video] fix wrong cast (#12511)
    • [codec,openh264] reject encoder ABI mismatch on runtime-loaded library (#12510)
    • [client,sdl] create a copy of rdpPointer (#12512)
    • [codec,video] properly pass intermediate format (#12518)
    • [utils, signal] lazily initialize Windows CRITICAL_SECTION to match POSIX static mutex behavior (#12520) winpr: improve libunwind backtraces (#12530)
    • [server,shadow] remember selected caps (#12528)
    • Zero credential data before free in NLA and NTLM context (#12532)
    • [server,proxy] ignore missing client in input channel (#12536)
    • [server,proxy] ignore rdpdr messages (#12537)
    • [winpr,sspi] improve kerberos logging (#12538)
    • Codec fixes (#12542)

  • Version 3.24.1:

    • [warnings] fix various sign and cast warnings (#12480)
    • [client,x11] start with xfc->remote_app = TRUE; (#12491)
    • Sam file read regression fix (#12484)
    • [ncrypt,smartcardlogon] support ECC keys in PKCS#11 smartcard enumeration (#12490)
    • Fix: memory leak in rdp_client_establish_keys() (#12494)
    • Fix memory leak in freerdp_settings_int_buffer_copy() on…
Record
openSUSE-SU-2026:20657-1
Updated
2026-11-02
OSVSUSE-SU-2026:1633-1 No score

Security update for freerdp

This update for freerdp fixes the following issues:

  • CVE-2026-25941: Out-of-Bounds Read in client RDPGFX channel via crafted WIRE_TO_SURFACE_2 PDU (bsc#1258919).
  • CVE-2026-25942: Global-buffer-overflow in xf_rail_server_execute_result (bsc#1258920).
  • CVE-2026-25952: Heap-use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
  • CVE-2026-25953: Heap-use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
  • CVE-2026-25954: Heap-use-after-free in xf_rail_server_local_move_size (bsc#1258924).
  • CVE-2026-25955: Heap-use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258973).
  • CVE-2026-25959: Heap-use-after-free in xf_cliprdr_provide_data_ (bsc#1258976).
  • CVE-2026-25997: Heap-use-after-free in xf_clipboard_format_equal (bsc#1258977).
  • CVE-2026-26986: Heap-use-after-free in rail_window_free (bsc#1258967).
  • CVE-2026-27015: Smartcard NDR alignment padding triggers reachable WINPR_ASSERT abort (bsc#1258987).
  • CVE-2026-27950: Denial of service due to incomplete fix for heap-use-after-free vulnerability (bsc#1258941).
  • CVE-2026-27951: Denial of service via endless blocking loop in Stream_EnsureCapacity (bsc#1258939).
  • CVE-2026-29774: Missing bounds validation can cause a client-side heap buffer overflow (bsc#1259689).
  • CVE-2026-29775: Malicious server can trigger a client-side heap out-of-bounds access (bsc#1259684).
  • CVE-2026-29776: Missing length check can lead to an integer underflow (bsc#1259692).
  • CVE-2026-31897: Missing length check can cause an out-of-bounds read (bsc#1259693).
Record
SUSE-SU-2026:1633-1
Updated
2026-11-02
OSVSUSE-SU-2026:21436-1 No score

Security update for freerdp

This update for freerdp fixes the following issues:

Update to version 3.24.2.

Security issues fixed:

  • CVE-2026-25941: out-of-bounds read in the FreeRDP client RDPGFX channel (bsc#1258919).
  • CVE-2026-25942: buffer overflow of global array in xf_rail_server_execute_result (bsc#1258920).
  • CVE-2026-25952: heap use-after-free in xf_SetWindowMinMaxInfo (bsc#1258921).
  • CVE-2026-25953: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258923).
  • CVE-2026-25954: heap use-after-free in xf_rail_server_local_move_size (bsc#1258924).
  • CVE-2026-25955: heap use-after-free in xf_AppUpdateWindowFromSurface (bsc#1258973).
  • CVE-2026-25959: heap use-after-free in xf_cliprdr_provide_data_ (bsc#1258976).
  • CVE-2026-25997: heap use-after-free in xf_clipboard_format_equal (bsc#1258977).
  • CVE-2026-26271: buffer overread in FreeRDP icon processing (bsc#1258979).
  • CVE-2026-26955: out-of-bounds write in FreeRDP clients using the GDI surface pipeline (bsc#1258982).
  • CVE-2026-26965: out-of-bounds write in FreeRDP client RLE planar decode path (bsc#1258985).
  • CVE-2026-29774: heap buffer overflow in the FreeRDP client's AVC420/AVC444 YUV-to-RGB conversion path (bsc#1259689).
  • CVE-2026-29775: out-of-bounds access in the FreeRDP client bitmap cache subsystem (bsc#1259684).
  • CVE-2026-29776: integer underflow in update_read_cache_bitmap_order (bsc#1259692).
  • CVE-2026-31806: heap buffer overflow in nsc_process_message (bsc#1259653).
  • CVE-2026-31883: heap buffer overwrite due to a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders (bsc#1259679).
  • CVE-2026-31884: division by zero in MS-ADPCM and IMA-ADPCM decoders (bsc#1259680).
  • CVE-2026-31885: out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders (bsc#1259686).
  • CVE-2026-31897: out-of-bounds read in freerdp_bitmap_decompress_planar (bsc#1259693).
  • CVE-2026-33952: client-side crash due to WINPR_ASSERT() failure in rts_read_auth_verifier_no_checks() (bsc#1261196).
  • CVE-2026-33977: client-side crash due to WINPR_ASSERT() failure in IMA ADPCM audio decoder (bsc#1261198).
  • CVE-2026-33982: heap buffer overread in in winpr_aligned_offset_recalloc (bsc#1261222).
  • CVE-2026-33983: undefined behavior and resource exhaustion via 80 billion iteration loop in progressive_decompress_tile_upgrade (bsc#1261200).
  • CVE-2026-33984: heap buffer overflow in ClearCodec resize_vbar_entry (bsc#1261211).
  • CVE-2026-33985: heap out-of-bounds read in clear_decompress_glyph_data (bsc#1261217).
  • CVE-2026-33986: heap out-of-bounds write due to H.264 YUV buffer dimension desync (bsc#1261223).
  • CVE-2026-33987: heap out-of-bounds write due to persistent cache bmpSize desync (bsc#1261226).
  • CVE-2026-33995: double-free vulnerability in kerberos_AcceptSecurityContext and kerberos_InitializeSecurityContextA (bsc#1261227).

Other updates and bugfixes:

  • Version 3.24.2:

    • [channels,video] fix wrong cast (#12511)
    • [codec,openh264] reject encoder ABI mismatch on runtime-loaded library (#12510)
    • [client,sdl] create a copy of rdpPointer (#12512)
    • [codec,video] properly pass intermediate format (#12518)
    • [utils, signal] lazily initialize Windows CRITICAL_SECTION to match POSIX static mutex behavior (#12520) winpr: improve libunwind backtraces (#12530)
    • [server,shadow] remember selected caps (#12528)
    • Zero credential data before free in NLA and NTLM context (#12532)
    • [server,proxy] ignore missing client in input channel (#12536)
    • [server,proxy] ignore rdpdr messages (#12537)
    • [winpr,sspi] improve kerberos logging (#12538)
    • Codec fixes (#12542)

  • Version 3.24.1:

    • [warnings] fix various sign and cast warnings (#12480)
    • [client,x11] start with xfc->remote_app = TRUE; (#12491)
    • Sam file read regression fix (#12484)
    • [ncrypt,smartcardlogon] support ECC keys in PKCS#11 smartcard enumeration (#12490)
    • Fix: memory leak in rdp_client_establish_keys() (#12494)
    • Fix memory leak in freerdp_settings_int_buffer_copy() on…
Record
SUSE-SU-2026:21436-1
Updated
2026-11-02
OSVUSN-8105-1 No score

freerdp3 vulnerabilities

It was discovered that FreeRDP incorrectly handled certain RDP packets. A remote attacker could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-8105-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
freerdp
Alpine:v3.23
 before 3.23.0-r0
3.23.0-r0
freerdp
Alpine:v3.24
 before 3.23.0-r0
3.23.0-r0
freerdp2
Debian:12
 All versions, plus listed versions
2.10.0+dfsg1-12.10.0+dfsg1-1.12.11.2+dfsg1-12.11.2+dfsg1-1.1~exp12.11.2+dfsg1-1.1~exp2
Show 8 moreShow less
2.11.5+dfsg1-12.11.7+dfsg1-12.11.7+dfsg1-22.11.7+dfsg1-32.11.7+dfsg1-42.11.7+dfsg1-52.11.7+dfsg1-62.11.7+dfsg1-6~deb12u1
 None known
freerdp3
Debian:13
 before 3.15.0+dfsg-2.1+deb13u1, plus listed versions
3.15.0+dfsg-2.1
3.15.0+dfsg-2.1+deb13u1
freerdp3
Debian:14
 before 3.23.0+dfsg-1, plus listed versions
3.15.0+dfsg-2.13.16.0+dfsg-13.16.0+dfsg-23.17.0+dfsg-13.17.1+dfsg-1
Show 15 moreShow less
3.17.1+dfsg-23.17.2+dfsg-13.17.2+dfsg-23.17.2+dfsg-33.18.0+dfsg-13.19.0+dfsg-13.19.1+dfsg-13.20.0+dfsg-13.20.2+dfsg-13.21.0+dfsg-13.22.0+dfsg-13.22.0+dfsg-1~bpo13+03.22.0+dfsg-1~bpo13+13.22.0+dfsg-33.23.0+dfsg-1~bpo13+1
3.23.0+dfsg-1
freerdp
Mageia:10
 before 3.31.0-1.mga10
3.31.0-1.mga10
freerdp
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.1.0~git20140921.1.440916e+dfsg1-5ubuntu11.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.21.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.31.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4
 None known
freerdp2
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.0.0~git20170725.1.1648deb+dfsg1-12.0.0~git20170725.1.1648deb+dfsg1-52.0.0~git20170725.1.1648deb+dfsg1-5ubuntu12.0.0~git20170725.1.1648deb+dfsg1-5ubuntu22.0.0~git20170725.1.1648deb+dfsg1-6
Show 14 moreShow less
2.0.0~git20170725.1.1648deb+dfsg1-6build12.0.0~git20170725.1.1648deb+dfsg1-72.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.12.1.1+dfsg1-0ubuntu0.18.04.12.2.0+dfsg1-0ubuntu0.18.04.12.2.0+dfsg1-0ubuntu0.18.04.22.2.0+dfsg1-0ubuntu0.18.04.32.2.0+dfsg1-0ubuntu0.18.04.42.2.0+dfsg1-0ubuntu0.18.04.4+esm12.2.0+dfsg1-0ubuntu0.18.04.4+esm22.2.0+dfsg1-0ubuntu0.18.04.4+esm32.2.0+dfsg1-0ubuntu0.18.04.4+esm42.2.0+dfsg1-0ubuntu0.18.04.4+esm52.2.0+dfsg1-0ubuntu0.18.04.4+esm6
 None known
freerdp
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.1.0~git20140921.1.440916e+dfsg1-15ubuntu11.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.11.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2
 None known
freerdp2
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.0.0~git20190204.1.2693389a+dfsg1-12.0.0~git20190204.1.2693389a+dfsg1-22.0.0~git20190204.1.2693389a+dfsg1-2build12.0.0~git20190204.1.2693389a+dfsg1-2build22.1.1+dfsg1-0ubuntu0.20.04.1
Show 12 moreShow less
2.2.0+dfsg1-0ubuntu0.20.04.12.2.0+dfsg1-0ubuntu0.20.04.22.2.0+dfsg1-0ubuntu0.20.04.32.2.0+dfsg1-0ubuntu0.20.04.42.2.0+dfsg1-0ubuntu0.20.04.52.2.0+dfsg1-0ubuntu0.20.04.62.6.1+dfsg1-0ubuntu0.20.04.12.6.1+dfsg1-0ubuntu0.20.04.22.6.1+dfsg1-0ubuntu0.20.04.2+esm12.6.1+dfsg1-0ubuntu0.20.04.2+esm22.6.1+dfsg1-0ubuntu0.20.04.2+esm32.6.1+dfsg1-0ubuntu0.20.04.2+esm4
 None known
Show 5 moreShow less
Affected packages
PackageAffectedFixed
freerdp2
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.3.0+dfsg1-2build12.3.0+dfsg1-2ubuntu12.3.0+dfsg1-2ubuntu22.4.1+dfsg1-12.4.1+dfsg1-1ubuntu1
Show 18 moreShow less
2.4.1+dfsg1-1ubuntu22.5.0+dfsg1-12.6.0+dfsg1-12.6.1+dfsg1-12.6.1+dfsg1-32.6.1+dfsg1-3ubuntu12.6.1+dfsg1-3ubuntu22.6.1+dfsg1-3ubuntu2.12.6.1+dfsg1-3ubuntu2.22.6.1+dfsg1-3ubuntu2.32.6.1+dfsg1-3ubuntu2.42.6.1+dfsg1-3ubuntu2.52.6.1+dfsg1-3ubuntu2.62.6.1+dfsg1-3ubuntu2.72.6.1+dfsg1-3ubuntu2.82.6.1+dfsg1-3ubuntu2.92.6.1+dfsg1-3ubuntu2.102.6.1+dfsg1-3ubuntu2.11
 None known
freerdp3
Ubuntu:24.04:LTS
 before 3.5.1+dfsg1-0ubuntu1.4, plus listed versions
3.4.0+dfsg1-0ubuntu23.4.0+dfsg1-0ubuntu33.4.0+dfsg1-0ubuntu43.5.0+dfsg1-0ubuntu13.5.1+dfsg1-0ubuntu13.5.1+dfsg1-0ubuntu1.13.5.1+dfsg1-0ubuntu1.2
3.5.1+dfsg1-0ubuntu1.4
freerdp2
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
2.10.0+dfsg1-1.1ubuntu12.11.2+dfsg1-12.11.2+dfsg1-1build12.11.2+dfsg1-1build32.11.5+dfsg1-1build1
Show 7 moreShow less
2.11.5+dfsg1-1build22.11.5+dfsg1-1ubuntu0.1~esm12.11.5+dfsg1-1ubuntu0.1~esm22.11.5+dfsg1-1ubuntu0.1~esm32.11.5+dfsg1-1ubuntu0.1~esm42.11.5+dfsg1-1ubuntu0.1~esm52.11.5+dfsg1-1ubuntu0.1~esm6
 None known
freerdp3
Ubuntu:25.10
 before 3.16.0+dfsg-2ubuntu0.3, plus listed versions
3.14.0+dfsg-1ubuntu13.15.0+dfsg-2.13.16.0+dfsg-1ubuntu13.16.0+dfsg-23.16.0+dfsg-2ubuntu0.1
3.16.0+dfsg-2ubuntu0.3
freerdp
openSUSE:Tumbleweed
 before 3.24.1-1.1
3.24.1-1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected, aliases, publishedEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-25959 is a medium vulnerability (CVSS 5.5) in Freerdp, published February 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. Fixed in freerdp 3.23.0-r0.

References

Show 104 moreShow less
This page doesn't list everything

Left out here: the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open