FreeRDP up to 3.26.9 RPC Client rpc_client.c rpc_client_recv_fragment heap-based overflow

Summaryinfo

A vulnerability has been found in FreeRDP up to 3.26.9 and classified as critical. This affects the function rpc_client_recv_fragment of the file libfreerdp/core/gateway/rpc_client.c of the component RPC Client. The manipulation leads to heap-based overflow. This vulnerability is listed as CVE-2026-55194. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in FreeRDP up to 3.26.9. It has been rated as critical. This issue affects the function rpc_client_recv_fragment of the file libfreerdp/core/gateway/rpc_client.c of the component RPC Client. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the server-declared alloc_hint rather than the actual StubLength about to be written. A malicious TS Gateway can send a PTYPE_RESPONSE with a small alloc_hint and a much larger frag_length, causing Stream_Write to copy attacker-controlled stub data beyond the 4096-byte pdu->s buffer. This can crash the client and may permit code execution through heap corruption. This issue is fixed in version 3.27.0.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-55194 since 06/16/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 3.27.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Remote Access Software

Name

• FreeRDP

Version

• 3.26.0
• 3.26.1
• 3.26.2
• 3.26.3
• 3.26.4
• 3.26.5
• 3.26.6
• 3.26.7
• 3.26.8
• 3.26.9

License

• open-source

Website

• Product: https://github.com/FreeRDP/FreeRDP/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion