CVE-2026-55192
Received Received - Intake

Heap-based Buffer Overflow in FreeRDP H.264 Decoder

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder backends can return YUV planes sized from the bitstream without comparing the decoded width and height to the RDPGFX surface dimensions used to validate region rectangles. A malicious RDP server can provide an AVC420 or AVC444 bitstream whose decoded frame is smaller than the negotiated surface, causing yuv420_context_decode and the YUV-to-RGB conversion paths to read beyond the decoder-owned planes in libfreerdp/codec/h264.c and the selected H.264 backend. This can disclose client memory or crash the client. This issue is fixed in version 3.27.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-55192
EUVD
EUVD-2026-62668

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
freerdp freerdp 3.27.0
freerdp freerdp to 3.27.0 (exc)
freerdp freerdp to 3.26.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an out-of-bounds read vulnerability in FreeRDP clients (like xfreerdp) when connecting to a malicious RDP server. It occurs during H.264 YUV-to-RGB conversion due to a mismatch between decoder and surface dimensions. The decoder returns YUV planes sized from the bitstream without comparing to the RDPGFX surface dimensions, causing reads beyond allocated memory when converting smaller decoded frames to surface-sized rectangles.

Detection Guidance

To detect this vulnerability, check if your FreeRDP version is 3.26.0 or older. Run 'xfreerdp --version' or 'freerdp2 --version' to verify. If using a vulnerable version, monitor for crashes during RDP sessions with H.264 decoding enabled. Enable AddressSanitizer (ASAN) in builds to catch out-of-bounds reads during H.264 decoding.

Impact Analysis

A malicious RDP server could exploit this to read client memory or crash the client application. This may lead to information disclosure or denial-of-service. The impact requires connecting to a compromised server with H.264 decoding enabled and specific surface/H.264 dimension mismatches.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially exposing sensitive client memory during RDP sessions. Out-of-bounds reads may lead to unauthorized data disclosure, violating confidentiality requirements under these regulations. Organizations handling protected health or personal data must ensure FreeRDP is updated to mitigate this risk.

Mitigation Strategies

Upgrade FreeRDP to version 3.27.0 or later immediately. Disable H.264 decoding in RDP sessions if upgrading is not possible. Avoid connecting to untrusted RDP servers. Monitor for crashes or memory leaks during RDP sessions as potential indicators of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55192. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart