VDB
CVE-2026-55194
CVE-2026-55194
PUBLISHED
CVSS 8.7 HIGH
Reported by GitHub_M · Published August 19, 2026
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the server-declared alloc_hint rather than the actual StubLength about to be written. A malicious TS Gateway can send a PTYPE_RESPONSE with a small alloc_hint and a much larger frag_length, causing Stream_Write to copy attacker-controlled stub data beyond the 4096-byte pdu->s buffer. This can crash the client and may permit code execution through heap corruption. This issue is fixed in version 3.27.0.
Risk Scores
CVSS 4.0
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| FreeRDP | FreeRDP | < 3.27.0 |
| FreeRDP | FreeRDP | < 3.27.0, < 3.27.0, < 3.27.0 |
| alpine | freerdp | 0, 0, 0 |
Timeline
- Jun 19, 2026 CVE Published
- Aug 24, 2026 EPSS Score
- Aug 26, 2026 EPSS Score
- Aug 30, 2026 EPSS Score
- Aug 31, 2026 Distribution Patch
- Aug 31, 2026 Security Advisory
- Aug 31, 2026 Distribution Patch
- Aug 31, 2026 Security Advisory
- Sep 1, 2026 Security Advisory
- Sep 2, 2026 Distribution Patch
- Sep 2, 2026 Security Advisory
- Sep 3, 2026 EPSS Score
References
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9gxm-3mf5-f5cx x_refsource_CONFIRM
- https://github.com/FreeRDP/FreeRDP/pull/12873 x_refsource_MISC
- https://github.com/FreeRDP/FreeRDP/commit/9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a x_refsource_MISC
- https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0 x_refsource_MISC