CVE-2026-55191 in FreeRDP
Summary
by MITRE • 08/19/2026
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444_ensure_buffer. A malicious RDP server can supply surface dimensions for which piDstStride multiplied by padDstHeight wraps to a small nonzero value, causing winpr_aligned_recalloc to allocate an undersized buffer before YUV420CombineToYUV444 writes using the actual stride and rectangle dimensions. This can cause a client crash and may permit code execution through attacker-influenced heap corruption. This issue is fixed in version 3.27.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
FreeRDP serves as a widely adopted open-source implementation of the Remote Desktop Protocol, facilitating remote access to Windows-based systems across various operating environments. The vulnerability identified within versions prior to 3.27.0 resides specifically in the H.264 video codec backend used for handling RDPGFX AVC444 streams. This component is responsible for decoding high-quality video data transmitted by Remote Desktop servers, a feature increasingly utilized due to its superior compression and visual fidelity compared to older codecs like JPEG or MPEG4. The core technical flaw lies in the function avc444_ensure_buffer located within libfreerdp/codec/h264.c, where the system calculates the necessary memory allocation size for intermediate YUV444 pixel buffers.
The fundamental defect is a classic integer overflow vulnerability resulting from the use of 32-bit arithmetic during buffer size calculation. Specifically, when determining the required buffer space, the code multiplies piDstStride by padDstHeight using fixed-width 32-bit integers. If an attacker-controlled RDP server provides surface dimensions that result in a product exceeding the maximum value representable by a signed or unsigned 32-bit integer, the multiplication operation wraps around to yield a significantly smaller nonzero value rather than triggering an error condition. This mathematical overflow causes the subsequent call to winpr_aligned_recalloc to allocate a heap buffer that is drastically undersized relative to the actual data requirements dictated by the true stride and rectangle dimensions of the video frame.
Upon allocation, the application proceeds with decoding operations using YUV420CombineToYUV444, which writes pixel data into the allocated buffer based on the actual, much larger dimensions provided in the stream header rather than the truncated size used for allocation. This discrepancy leads to a heap-based buffer overflow where write operations extend far beyond the boundaries of the allocated memory region. The immediate operational impact is typically a client crash due to memory access violations or corruption of adjacent heap metadata structures. However, the severity escalates significantly when considering the potential for remote code execution. By carefully crafting the input dimensions and potentially manipulating subsequent allocations through heap grooming techniques, an attacker can overwrite critical data structures such as function pointers or object headers within the heap.
This vulnerability maps directly to CWE-190, which defines integer overflow or wraparound errors that lead to other weaknesses like buffer overflows. In terms of offensive security frameworks, this exploit scenario aligns with MITRE ATT&CK technique T1203, specifically the exploitation of vulnerabilities for client-side code execution via remote services. The attack vector involves a malicious server initiating an RDP connection and transmitting specially crafted video frames that trigger the overflow condition during the decoding phase. This represents a high-severity risk because it allows unauthenticated or authenticated attackers to achieve arbitrary code execution on vulnerable clients, potentially leading full system compromise depending on user privileges and security configurations in place.
Mitigation strategies primarily involve upgrading FreeRDP to version 3.27.0 or later, where the developers have implemented proper bounds checking and utilized larger integer types for buffer size calculations to prevent wraparound behavior. For organizations unable to immediately patch all endpoints, network-level controls such as firewalls can be configured to restrict RDP traffic from untrusted sources or to inspect video streams if deep packet inspection capabilities are available. Additionally, enabling strict memory protection features like Address Space Layout Randomization and Data Execution Prevention on client systems can mitigate the likelihood of successful code execution even if a buffer overflow occurs by making it more difficult for attackers to reliably target specific memory addresses or execute injected shellcode.