CVE-2026-55194
Received Received - Intake

Remote Code Execution in FreeRDP via TS Gateway Heap Overflow

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the server-declared alloc_hint rather than the actual StubLength about to be written. A malicious TS Gateway can send a PTYPE_RESPONSE with a small alloc_hint and a much larger frag_length, causing Stream_Write to copy attacker-controlled stub data beyond the 4096-byte pdu->s buffer. This can crash the client and may permit code execution through heap corruption. This issue is fixed in version 3.27.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-55194
EUVD
EUVD-2026-62667

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
freerdp freerdp 3.27.0
freerdp freerdp to 3.27.0 (exc)
freerdp freerdp From 3.0.0 (inc) to 3.27.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55194 is a heap-buffer-overflow vulnerability in FreeRDP's TS Gateway RPC RESPONSE reassembly mechanism. The issue occurs when a FreeRDP client processes a PTYPE_RESPONSE PDU over the RPC OUT channel during gateway negotiation. The client's rpc_client_recv_fragment() function uses only the server-declared alloc_hint to determine buffer capacity, without accounting for the actual stub data length.

Detection Guidance

Detecting this vulnerability requires monitoring FreeRDP versions and network traffic for malformed RPC RESPONSE PDUs. Check FreeRDP version with 'xfreerdp --version' or 'apt show freerdp2-x11'. Inspect gateway traffic for unusually large fragments with small alloc_hint values. Use Wireshark filters like 'tcp.port==3389 && rdp' to analyze RDP traffic patterns.

Impact Analysis

A malicious gateway can exploit this by sending a small alloc_hint while including a large fragment, causing the client to copy attacker-controlled data into a buffer. This results in a heap overflow, potentially crashing the client (denial of service) or allowing heap metadata corruption and remote code execution in release builds without assertions enabled.

Compliance Impact

This vulnerability primarily impacts system integrity and availability rather than directly violating compliance standards like GDPR or HIPAA. However, it could indirectly affect compliance by enabling unauthorized code execution or data breaches if exploited, potentially leading to unauthorized access to sensitive data processed by FreeRDP clients.

Mitigation Strategies

Upgrade FreeRDP to version 3.27.0 or later immediately. If upgrading is not possible, disable TS Gateway functionality or restrict access to untrusted networks. Monitor for crashes or unusual behavior in FreeRDP clients. Apply network-level mitigations like blocking suspicious RPC traffic at the firewall.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55194. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart