CVE-2026-55564 in FreeRDP
Summary
by MITRE • 08/19/2026
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater than cache->number instead of greater than or equal to it. A malicious RDP server can use GLYPH_FRAGMENT_USE replay in update_process_glyph_fragments to make the default cache receive index 254 when cache->number is 254, reading one pointer beyond the entries array and dereferencing it as a glyph. This can crash the client and may disclose adjacent heap data. This issue is fixed in version 3.27.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in FreeRDP prior to version 3.27.0 represents a critical off-by-one error within the glyph caching subsystem, specifically located in the libfreerdp/cache/glyph.c module. This flaw stems from an incorrect boundary check implemented in the glyph_cache_get function. The code logic verifies whether the requested index is strictly greater than cache->number to determine if access should be denied. However, standard array indexing conventions dictate that valid indices range from zero up to and including size minus one. Consequently, when the cache contains 254 entries, indexed from zero to two hundred fifty-three, a request for index two hundred fifty-four is erroneously permitted because it is not greater than two hundred fifty-four. This logical oversight allows an attacker to bypass memory safety checks that are designed to prevent out-of-bounds access.
The operational impact of this vulnerability is significant and can be triggered by interacting with a malicious Remote Desktop Protocol server. An adversary can exploit the flaw by sending specifically crafted GLYPH_FRAGMENT_USE replay messages through the update_process_glyph_fragments routine. By forcing the client application to request an index equal to cache->number, such as two hundred fifty-four when that value is set to two hundred fifty-four, the system proceeds to access memory outside the bounds of the allocated entries array. This action results in reading one pointer beyond the end of the glyph cache structure. The application then attempts to dereference this invalid memory address as a valid glyph object, leading to immediate instability within the client process.
From a security perspective, this vulnerability is classified under CWE-193: Off-by-One Error and aligns with ATT&CK technique T1059.007: Command and Scripting Interpreter via Windows Remote Management or similar remote execution vectors if combined with other exploits. The immediate consequence of the out-of-bounds read is typically a denial of service, manifesting as a crash in the FreeRDP client application due to an invalid memory access exception. However, beyond simple disruption, this flaw poses a serious risk of information disclosure. By reading adjacent heap data, an attacker may potentially extract sensitive information stored in neighboring memory locations, such as pointers or other structured data, which could be leveraged for further exploitation attempts like arbitrary code execution if combined with additional vulnerabilities.
Mitigation strategies primarily involve upgrading the FreeRDP installation to version 3.27.0 or later, where this boundary check has been corrected to use a greater-than-or-equal-to comparison. For environments unable to immediately patch, network-level controls such as firewalls can be configured to restrict RDP traffic from untrusted sources. Additionally, implementing strict input validation on the server side and monitoring for anomalous glyph fragment patterns may help detect attempted exploitation before it triggers the memory error. Regular security audits of remote desktop implementations are recommended to ensure that similar off-by-one errors in other subsystems do not exist within the codebase.