EXPOSURES › CVE-2026-55191
CVE-2026-55191
CRITICALA malicious RDP server can exploit a heap corruption flaw in FreeRDP's H.264 decoder to crash the client and execute arbitrary code.
FreeRDP clients negotiating RDPGFX AVC444 with an H.264 decoder backend are vulnerable to heap corruption via attacker-supplied surface dimensions, enabling remote code execution. DIB organizations must patch FreeRDP to version 3.27.0 or higher immediately, as this flaw allows adversaries to compromise remote desktop sessions and execute malicious payloads on client systems.
Shame score — A critical RCE in a widely deployed open-source RDP client, exploitable via a malicious RDP server, represents a severe avoidable failure in the security posture of remote access infrastructure.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444_ensure_buffer. A malicious RDP server can supply surface dimensions for which piDstStride multiplied by padDstHeight wraps to a small nonzero value, causing winpr_aligned_recalloc to allocate an undersized buffer before YUV420CombineToYUV444 writes using the actual stride and rectangle dimensions. This can cause a client crash and may permit code execution through attacker-influenced heap corruption. This issue is fixed in version 3.27.0.