CVE-2026-55191 FreeRDP CVE debrief

Who should care

Remote desktop service administrators and users of FreeRDP clients should assess exposure and prioritize updates to prevent potential crashes and code execution. This includes reviewing and restricting RDP access to trusted sources, monitoring client logs for suspicious activity, and verifying that all clients are updated to version 3.27.0. Additionally, administrators should conduct a thorough review of RDP access controls and implement additional logging

Why it matters

CVE-2026-55191 is a high-severity vulnerability in FreeRDP clients that can cause crashes and potentially allow code execution. Remote desktop service administrators and users should prioritize updating to version 3.27.0 and restrict RDP access to trusted sources.

• Potential client crashes due to malicious RDP server activity
• Possible code execution through heap corruption
• Need for version 3.27.0 update verification
• Importance of restricting RDP access to trusted sources

Technical summary

FreeRDP clients negotiating RDPGFX AVC444 with an H.264 decoder backend are vulnerable to a buffer allocation issue, allowing a malicious RDP server to cause a client crash and potentially permit code execution through heap corruption. The vulnerability arises from a 32-bit multiplication in avc444_ensure_buffer that calculates the intermediate YUV444 allocation size. A malicious RDP server can supply surface dimensions for which piDstStride multiplied by padDstHeight wraps to a small nonzero value, causing winpr_aligned_recalloc to allocate an undersized buffer before YUV420CombineToYUV444 writes using the actual stride and rectangle dimensions.

Defensive priority

Remote desktop service administrators should prioritize updating FreeRDP clients to version 3.27.0 to prevent potential crashes and code execution.

Recommended defensive actions

• Update FreeRDP clients to version 3.27.0
• Review and restrict RDP access to trusted sources
• Monitor FreeRDP client logs for suspicious activity
• Verify that all FreeRDP clients are updated to version 3.27.0
• Conduct a thorough review of RDP access controls and restrict access to trusted sources
• Implement additional monitoring and logging to detect potential exploitation attempts
• Perform a comprehensive asset inventory to identify all affected systems

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on exploitation or affected systems is limited. There is no evidence of public exploitation or widespread attacks. The FreeRDP project has addressed the issue in version 3.27.0, and users should prioritize updating to this version. The vulnerability affects FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend. The issue is not related to the RDP server itself but rather to the client implementation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.