diff --git a/vnc.c b/vnc.c
index cc2a26e..92facde 100644
--- a/vnc.c
+++ b/vnc.c
@@ -2345,7 +2345,7 @@
 static void vnc_refresh(void *opaque)
 {
     VncDisplay *vd = opaque;
-    VncState *vs = NULL;
+    VncState *vs = NULL, *vn = NULL;
     int has_dirty = 0, rects = 0;
 
     vga_hw_update();
@@ -2354,8 +2354,10 @@
 
     vs = vd->clients;
     while (vs != NULL) {
+        vn = vs->next;
         rects += vnc_update_client(vs, has_dirty);
-        vs = vs->next;
+        /* vs might be free()ed here */
+        vs = vn;
     }
     /* vd->timer could be NULL now if the last client disconnected,
      * in this case don't update the timer */