CVE-2026-25997: Freerdp Xf Cliprdr Free Last Sent Formats Without X11 Lock
xf_cliprdr_free_formats is called on $C->lastSentFormats without the surrounding xf_lock_x11/xf_unlock_x11 pair. The cliprdr channel thread can free this array while the X11 event thread concurrently iterates it in xf_clipboard_changed / xf_clipboard_format_equal, producing a heap use-after-free (CVE-2026-25997, CWE-416). Serialize the free with xf_lock_x11(
Cgreprules fetch cve-2026-25997-freerdp-xf-cliprdr-free-last-sent-formats-without-x11-lock --engine opengrepDescription
xf_cliprdr_free_formats is called on $C->lastSentFormats without the surrounding xf_lock_x11/xf_unlock_x11 pair. The cliprdr channel thread can free this array while the X11 event thread concurrently iterates it in xf_clipboard_changed / xf_clipboard_format_equal, producing a heap use-after-free (CVE-2026-25997, CWE-416). Serialize the free with xf_lock_x11(
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.