CVE-2026-55564 FreeRDP CVE debrief

Who should care

Administrators and users of FreeRDP clients, particularly those using versions prior to 3.27.0, should assess their exposure and consider upgrading to the latest version. This includes IT administrators responsible for managing RDP connections, security teams monitoring for potential threats, and operators using FreeRDP clients in their environments. Additionally, organizations that rely heavily on RDP connections for remote access should prioritize patch

Why it matters

CVE-2026-55564 is a medium-severity vulnerability in FreeRDP that can cause client crashes and potential data disclosure. Defenders should prioritize upgrading to version 3.27.0 or later, implement compensating controls, and monitor RDP connections.

• Potential client crashes due to malicious RDP server connections
• Possible disclosure of adjacent heap data
• Need for version verification and potential upgrades
• Importance of monitoring RDP connections for suspicious activity

Technical summary

The glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater than cache->number instead of greater than or equal to it. A malicious RDP server can use GLYPH_FRAGMENT_USE replay in update_process_glyph_fragments to make the default cache receive index 254 when cache->number is 254, reading one pointer beyond the entries array and dereferencing it as a glyph. This can crash the client and may disclose adjacent heap data. The vulnerability is caused by a flawed index check, which can lead to reading one pointer beyond the entries array and dereferencing it as a glyph.

Defensive priority

Medium priority for RDP client users and administrators

Recommended defensive actions

• Upgrade FreeRDP to version 3.27.0 or later
• Implement compensating controls, such as validating RDP server connections
• Monitor for suspicious RDP activity
• Review and verify RDP connection logs for potential malicious activity
• Conduct regular vulnerability assessments to identify exposed systems
• Prioritize patching for high-risk RDP connections
• Consider implementing additional security measures, such as multi-factor authentication for RDP connections

Evidence notes

The vulnerability is caused by a flawed index check in the glyph_cache_get function, which can lead to reading one pointer beyond the entries array and dereferencing it as a glyph. This can crash the client and may disclose adjacent heap data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.