CVE-2026-55193
Received Received - Intake

Buffer Overflow in FreeRDP Client via TS Gateway

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled max_xmit_frag value in libfreerdp/core/gateway/rpc_bind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise 65535 and then send a response fragment of the same length, causing rpc_channel_read in libfreerdp/core/gateway/rpc.c to write up to 65535 bytes into the smaller ReceiveFragment buffer. This can crash the client and may permit code execution through attacker-controlled heap corruption. This issue is fixed in version 3.27.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-55193
EUVD
EUVD-2026-62664

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
freerdp freerdp 3.27.0
freerdp freerdp to 3.27.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap-buffer-overflow vulnerability in FreeRDP's TS Gateway RPC fragment handling. A malicious gateway can send a large max_xmit_frag value (65535 bytes) during RPC bind, causing the client to allocate a small 4088-byte ReceiveFragment buffer. When processing response fragments, the client fails to validate the fragment length properly, leading to writing up to 65535 bytes into the smaller buffer. This causes heap corruption that can crash the client or potentially allow code execution.

Detection Guidance

Detecting this vulnerability requires monitoring FreeRDP clients using TS Gateway/RD Gateway transport (e.g., xfreerdp with /gateway: or /gt:rpc flags). Check FreeRDP version with `xfreerdp /version`; versions <= 3.26.0 are vulnerable. Monitor network traffic for RPC bind_ack packets with max_xmit_frag set to 65535. Use AddressSanitizer or similar tools during client execution to detect heap overflows.

Impact Analysis

If you connect to a FreeRDP client using a malicious TS Gateway/RD Gateway, this vulnerability could crash your client application or allow an attacker to execute arbitrary code on your system. The attack requires you to connect through a compromised gateway, but no additional user interaction is needed beyond normal connection setup.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially exposing sensitive data processed during RDP sessions. A heap corruption flaw in FreeRDP clients using TS Gateway may allow remote code execution or denial of service, risking unauthorized access to personal or health data. Organizations handling such data must ensure FreeRDP is updated to version 3.27.0 or later to mitigate this risk.

Mitigation Strategies

Upgrade FreeRDP to version 3.27.0 or later immediately. Avoid using TS Gateway/RD Gateway transport until patched. If upgrading is not possible, disable gateway RPC transport in clients by avoiding /gateway: or /gt:rpc flags. Monitor for suspicious RPC bind_ack packets with max_xmit_frag > 4088.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55193. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart