- Rebase onto vendor freerdp-2.11.7-1.amzn2.0.15, which fixes CVE-2026-63652 - CVE-2026-25959: retained TuxCare fix; lock the cliprdr cache when providing data, closing the use-after-free between the cliprdr channel thread and the X11 event thread in xf_cliprdr - CVE-2026-67288: retained TuxCare fix completing the vendor's backport, which left "data" uninitialised in PCSC_SCardReadCacheA() and the HashTable lookup in PCSC_SCardReadCacheW() unguarded against a NULL szLookupName key - CVE-2026-67301: complete the fix. Guarding the point allocation with numPoints > 0 left wParam->points, copied from the parser's own struct, aliasing polygon_{sc,cb}->points when numPoints is zero -- and update_message_free_update_class() frees it unconditionally, so the async consumer freed memory the parser still owns. Set it to NULL on that branch