CVE-2026-55192 FreeRDP CVE debrief

Who should care

Users of FreeRDP versions prior to 3.27.0 should update to the latest version to prevent potential memory disclosure or client crashes. This includes operators of RDP services, platform administrators, vulnerability management teams, and security teams responsible for monitoring and defending against potential exploitation attempts. Affected deployments may exist in managed environments, and owners should be assigned for follow-up and remediation planning.

Technical summary

FreeRDP H.264 decoder backends can return YUV planes sized from the bitstream without comparing the decoded width and height to the RDPGFX surface dimensions used to validate region rectangles. A malicious RDP server can provide an AVC420 or AVC444 bitstream whose decoded frame is smaller than the negotiated surface, causing yuv420_context_decode and the YUV-to-RGB conversion paths to read beyond the decoder-owned planes in libfreerdp/codec/h264.c and the selected H.264 backend. This issue allows for potential memory disclosure or client crashes. The vulnerability is fixed in FreeRDP version 3.27.0.

Defensive priority

High-priority defensive actions are required to address this vulnerability, as it allows for potential memory disclosure or client crashes.

Recommended defensive actions

• Update FreeRDP to version 3.27.0 or later
• Restrict access to RDP services
• Monitor for suspicious RDP activity
• Review system logs for potential exploitation attempts
• Verify FreeRDP version usage in environments
• Ensure RDP services are properly restricted and monitored
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

FreeRDP H.264 decoder backends can return YUV planes sized from the bitstream without comparing the decoded width and height to the RDPGFX surface dimensions used to validate region rectangles. Evidence from the CVE Program and NVD suggests that this issue is fixed in version 3.27.0. However, the CVE Program and NVD have limited information on the exact scope of affected deployments and potential exposure. Defenders should verify FreeRDP version usage in their environments, review system logs for potential exploitation attempts, and ensure that RDP services are properly restricted and monitored.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.