CVE-2026-55564 FreeRDP CVE debrief

Who should care

Organizations using FreeRDP for remote desktop connections should be aware of this vulnerability and take steps to mitigate it. This includes updating to version 3.27.0 or later, restricting access to RDP services, and monitoring for suspicious RDP activity. Security teams should review their asset inventory and prioritize patching based on exposure and potential impact. Vulnerability management processes should include checks for this issue, and compensating controls may be necessary for exposed systems.

Technical summary

The glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater than cache->number instead of greater than or equal to it. A malicious RDP server can use GLYPH_FRAGMENT_USE replay in update_process_glyph_fragments to make the default cache receive index 254 when cache->number is 254, reading one pointer beyond the entries array and dereferencing it as a glyph. This can crash the client and may disclose adjacent heap data. The vulnerability is addressed in FreeRDP version 3.27.0.

Defensive priority

Organizations using FreeRDP should prioritize updating to version 3.27.0 to address the vulnerability.

Recommended defensive actions

• Update FreeRDP to version 3.27.0 or later
• Restrict access to RDP services
• Monitor for suspicious RDP activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE-2026-55564 issue is related to FreeRDP, a free implementation of the Remote Desktop Protocol. The glyph_cache_get function in libfreerdp/cache/glyph.c has a vulnerability that allows a malicious RDP server to crash the client and potentially disclose adjacent heap data. Organizations should verify their deployments, review official advisories, and consider compensating controls. The issue is fixed in version 3.27.0. Evidence is limited to public sources and may not cover all affected systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.