CVE-2026-55191 FreeRDP CVE debrief

Who should care

Defenders responsible for FreeRDP client deployments should assess exposure and prioritize updates to prevent potential crashes and code execution. This includes reviewing client versions, configurations, and ensuring timely application of security patches. Security teams and vulnerability management teams should also be aware of the potential impacts and take necessary actions to secure their environments.

Why it matters

Defenders should prioritize updating FreeRDP clients to version 3.27.0 or later to prevent potential code execution and crashes. This vulnerability affects FreeRDP clients negotiating RDPGFX AVC444 with an H.264 decoder backend. Verification of client version and configuration is necessary to ensure security.

• Client crashes and potential code execution through heap corruption
• Verification of FreeRDP client version and configuration
• Monitoring for potential anomalies or crashes

Technical summary

FreeRDP clients negotiating RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444_ensure_buffer. A malicious RDP server can supply surface dimensions for which piDstStride multiplied by padDstHeight wraps to a small nonzero value, causing winpr_aligned_recalloc to allocate an undersized buffer before YUV420CombineToYUV444 writes using the actual stride and rectangle dimensions.

Defensive priority

Defenders should prioritize updating FreeRDP clients to version 3.27.0 or later to prevent potential code execution and crashes.

Recommended defensive actions

• Update FreeRDP clients to version 3.27.0 or later
• Review and verify the configuration of FreeRDP clients
• Monitor FreeRDP clients for potential crashes or anomalies
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The FreeRDP project has addressed this issue in version 3.27.0. There is no evidence of public exploitation at the time of CVE publication. The vulnerability affects FreeRDP clients negotiating RDPGFX AVC444 with an H.264 decoder backend. The issue has been fixed through a patch that modifies the allocation calculation to prevent buffer overflows. Defenders should verify client version and configuration to

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.