CVE-2026-55827 | FreeRDP is a free implementation of the Remote Desktop Proto… | CVSS 7.5 HIGH

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched with the non-default /cache:codec:rfx option pass desktop stride and height to RemoteFX decoding for Cache Bitmap V3 data while allocating bitmap->data only for the smaller DstWidth and DstHeight in gdi_Bitmap_Decompress, allowing a malicious RDP server to trigger a heap out-of-bounds write with attacker-controlled offset and content. This issue is fixed in version 3.27.1.

Metadata

CVE ID: CVE-2026-55827
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-17 16:29 UTC
Published: 2026-07-10 19:47 UTC
Last updated: 2026-07-10 20:15 UTC
Primary CWE: CWE-131
CWE-131: Incorrect Calculation of Buffer Size
Vendor / Product: FreeRDP / FreeRDP
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
FreeRDP	FreeRDP	—	< 3.27.1

Weakness (CWE)

CWE	Source	Description
CWE-131	cna	CWE-131: Incorrect Calculation of Buffer Size
CWE-787	cna	CWE-787: Out-of-bounds Write

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References (4)

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c495-h83v-3prp https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c495-h83v-3prp
https://github.com/FreeRDP/FreeRDP/pull/12899 https://github.com/FreeRDP/FreeRDP/pull/12899
https://github.com/FreeRDP/FreeRDP/commit/e58adf922ea4c0d5495e59a1fe488d70092e0e3e https://github.com/FreeRDP/FreeRDP/commit/e58adf922ea4c0d5495e59a1fe488d70092e0e3e
https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.1 https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.1