FreeRDP up to 3.26.x H.264 decoder backends libfreerdp/codec/h264.c yuv420_context_decode out-of-bounds

Summaryinfo

A vulnerability categorized as critical has been discovered in FreeRDP up to 3.26.x. The impacted element is the function yuv420_context_decode of the file libfreerdp/codec/h264.c of the component H.264 decoder backends. Executing a manipulation can lead to out-of-bounds. This vulnerability appears as CVE-2026-55192. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability has been found in FreeRDP up to 3.26.x and classified as critical. This vulnerability affects the function yuv420_context_decode of the file libfreerdp/codec/h264.c of the component H.264 decoder backends. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder backends can return YUV planes sized from the bitstream without comparing the decoded width and height to the RDPGFX surface dimensions used to validate region rectangles. A malicious RDP server can provide an AVC420 or AVC444 bitstream whose decoded frame is smaller than the negotiated surface, causing yuv420_context_decode and the YUV-to-RGB conversion paths to read beyond the decoder-owned planes in libfreerdp/codec/h264.c and the selected H.264 backend. This can disclose client memory or crash the client. This issue is fixed in version 3.27.0.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-55192 since 06/16/2026. The exploitation appears to be easy. The attack can be initiated remotely. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

Upgrading to version 3.27.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Remote Access Software

Name

• FreeRDP

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26

License

• open-source

Website

• Product: https://github.com/FreeRDP/FreeRDP/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion