---
id: CVE-2026-26986
title: FreeRDP has heap-use-after-free in rail_window_free
summary: >-
  FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to
  version 3.23.0, `rail_window_free` dereferences a freed `xfAppWindow` pointer
  during `HashTable_Free` cleanup because `xf_rail_window_common` calls
  `free(appWindow…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'
cvssSource: cna
cwe:
  - CWE-416
vendor: FreeRDP
product: FreeRDP
affected:
  - FreeRDP < 3.23.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-02-26T20:35:52.339851Z'
exploitAvailable: true
published: '2026-02-25'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T18:36:53.533Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-26986'
references:
  - url: 'https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-crqx-g6x5-rx47'
    label: 'https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-crqx-g6x5-rx47'
  - url: >-
      https://github.com/FreeRDP/FreeRDP/commit/b4f0f0a18fe53aa8d47d062f91471f4e9c5e0d51
    label: >-
      https://github.com/FreeRDP/FreeRDP/commit/b4f0f0a18fe53aa8d47d062f91471f4e9c5e0d51
  - url: >-
      https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1230-L1238
    label: >-
      https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1230-L1238
  - url: >-
      https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1297
    label: >-
      https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1297
  - url: >-
      https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1316-L1327
    label: >-
      https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L1316-L1327
  - url: >-
      https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L386-L394
    label: >-
      https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L386-L394
  - url: >-
      https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L395-L399
    label: >-
      https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L395-L399
  - url: >-
      https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L401-L404
    label: >-
      https://github.com/FreeRDP/FreeRDP/blob/5c7aae27d0417b42b4806c2a5c583ca39dd9ef1e/client/X11/xf_rail.c#L401-L404
tags:
  - cve.org
  - exploit-available
epss: 0.00786
epssPercentile: 0.5426
ingestedAt: '2026-09-17T19:26:25.352Z'
---

## Overview

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `rail_window_free` dereferences a freed `xfAppWindow` pointer during `HashTable_Free` cleanup because `xf_rail_window_common` calls `free(appWindow)` on title allocation failure without first removing the entry from the `railWindows` hash table, leaving a dangling pointer that is freed again on disconnect. Version 3.23.0 fixes the vulnerability.

## Affected

- `FreeRDP < 3.23.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.