CVE-2026-55193 FreeRDP CVE debrief

Who should care

Defenders responsible for remote desktop protocol clients using TS Gateway should assess exposure and verify the version of FreeRDP in use. Updating FreeRDP to version 3.27.0 or later will mitigate this vulnerability.

Why it matters

A vulnerability in FreeRDP allows a malicious gateway to potentially crash the client and may permit code execution through attacker-controlled heap corruption. Defenders should prioritize updating FreeRDP to version 3.27.0 or later and assess exposure of remote desktop protocol clients using TS Gateway.

• Potential client crash due to buffer overflow
• Possible code execution through attacker-controlled heap corruption
• Need to verify FreeRDP version in use
• Priority on updating to version 3.27.0 or later

Technical summary

The vulnerability is caused by the lack of bounding of the server-controlled max_xmit_frag value in libfreerdp/core/gateway/rpc_bind.c. A malicious gateway can advertise a large value and send a response fragment of the same length, causing rpc_channel_read in libfreerdp/core/gateway/rpc.c to write beyond the allocated ReceiveFragment buffer. This can crash the client and may permit code execution through attacker-controlled heap corruption.

Defensive priority

Defenders should prioritize updating FreeRDP to version 3.27.0 or later to mitigate this vulnerability. Remote desktop protocol clients using TS Gateway should assess exposure and verify the version of FreeRDP in use.

Recommended defensive actions

• Update FreeRDP to version 3.27.0 or later
• Assess exposure of remote desktop protocol clients using TS Gateway
• Verify the version of FreeRDP in use
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the lack of bounding of the server-controlled max_xmit_frag value in libfreerdp/core/gateway/rpc_bind.c. A malicious gateway can advertise a large value and send a response fragment of the same length, causing rpc_channel_read in libfreerdp/core/gateway/rpc.c to write beyond the allocated ReceiveFragment buffer.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.