CVE-2026-55191: FreeRDP RDPGFX AVC444 RCE Vulnerability

CVE-2026-55191 Overview

CVE-2026-55191 is a heap-based buffer overflow in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). The flaw affects FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend. In libfreerdp/codec/h264.c, the function avc444_ensure_buffer performs 32-bit multiplication when calculating the intermediate YUV444 allocation size. A malicious RDP server can supply crafted surface dimensions that cause the multiplication to wrap, resulting in an undersized allocation. The subsequent write via YUV420CombineToYUV444 uses the real stride and rectangle dimensions, producing heap corruption. The issue is fixed in FreeRDP version 3.27.0.

Critical Impact
A malicious RDP server can crash FreeRDP clients and potentially achieve remote code execution through attacker-influenced heap corruption when a user connects.

Affected Products

FreeRDP versions prior to 3.27.0
FreeRDP client builds negotiating RDPGFX AVC444 with an H.264 decoder backend
Downstream applications embedding vulnerable FreeRDP libraries

Discovery Timeline

2026-08-19 - CVE-2026-55191 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-55191

Vulnerability Analysis

The vulnerability is a classic integer wrap leading to a heap-based buffer overflow [CWE-122]. FreeRDP negotiates the RDPGFX channel to receive graphics updates encoded with the AVC444 mode, which uses H.264 for high-quality remote display. During buffer preparation, avc444_ensure_buffer multiplies piDstStride by padDstHeight using 32-bit arithmetic. When the server provides surface dimensions whose product exceeds UINT32_MAX, the value wraps to a small nonzero result. The allocator winpr_aligned_recalloc then reserves a buffer sized to the wrapped value.

The YUV420CombineToYUV444 routine subsequently writes YUV plane data using the untruncated stride and rectangle dimensions, exceeding the allocated region. The out-of-bounds write corrupts adjacent heap metadata and object contents. Because the overflow content is influenced by attacker-supplied graphics data, this primitive can be shaped to overwrite function pointers or other heap-resident structures, enabling code execution in the client process.

Root Cause

The root cause is missing overflow validation on a 32-bit multiplication. The original code trusted that piMainStride[0] * padDstHeight would fit in a UINT32. No prior check rejected zero-value operands or oversized products, so wraparound silently produced a small allocation size that was then used to size the destination buffer.

Attack Vector

Exploitation requires a victim FreeRDP client to connect to an attacker-controlled RDP server. The server negotiates RDPGFX AVC444 and sends surface descriptors chosen to trigger the wrap. User interaction is limited to initiating the RDP session, which is common in phishing scenarios that lure users to rogue remote-desktop gateways or hijacked kiosks.

 	if (pad != 0)
 		padDstHeight += 16 - pad;
 
-	if ((piMainStride[0] != piDstStride[0]) ||
-	    (piDstSize[0] != 1ull * piMainStride[0] * padDstHeight))
+	if ((piMainStride[0] == 0) || (padDstHeight == 0))
+		return FALSE;
+
+	const uint64_t dstsize = 1ull * piMainStride[0] * padDstHeight;
+	if (dstsize > UINT32_MAX)
+		return FALSE;
+
+	if ((piMainStride[0] != piDstStride[0]) || (piDstSize[0] != dstsize))
 	{
 		for (UINT32 x = 0; x < 3; x++)
 		{
 			piDstStride[x] = piMainStride[0];
 
+			const uint64_t dstride = 1ull * piDstStride[x] * padDstHeight;
+			if (dstride > UINT32_MAX)
+				return FALSE;
+
+			piDstSize[x] = WINPR_ASSERTING_INT_CAST(UINT32, dstride);
 			if (piDstSize[x] == 0)
 				return FALSE;
// Source: https://github.com/FreeRDP/FreeRDP/commit/97f40b9e766af375f4e41ac6a3f4397d708d249c

The patch rejects zero-valued stride or height, computes the product in 64-bit width, and returns FALSE when the result exceeds UINT32_MAX. See the FreeRDP Security Advisory GHSA-vx73-w5q6-7jqr for the coordinated disclosure record.

Detection Methods for CVE-2026-55191

Indicators of Compromise

FreeRDP client processes (xfreerdp, wlfreerdp, embedded clients) crashing shortly after establishing an RDP session.
Outbound RDP connections (TCP/3389) to untrusted or newly registered hosts, followed by client segmentation faults or heap corruption traces.
Core dumps or crash telemetry referencing avc444_ensure_buffer, YUV420CombineToYUV444, or winpr_aligned_recalloc.

Detection Strategies

Inventory endpoints for FreeRDP binaries and libraries below version 3.27.0 using software composition analysis.
Alert on FreeRDP process termination with SIGSEGV or SIGABRT correlated with an active RDP session.
Inspect RDPGFX capability negotiation in network traffic for AVC444 codec selection followed by anomalous surface dimensions.

Monitoring Recommendations

Log all outbound RDP connections and baseline expected destinations; flag deviations for review.
Capture endpoint telemetry for FreeRDP client crashes and forward stack traces to a central data lake for correlation.
Monitor package repositories and container images for FreeRDP versions preceding 3.27.0 during CI/CD scans.

How to Mitigate CVE-2026-55191

Immediate Actions Required

Upgrade all FreeRDP installations to version 3.27.0 or later using the FreeRDP 3.27.0 release notes.
Rebuild and redistribute downstream applications that statically link or bundle FreeRDP libraries.
Restrict outbound RDP connections from managed endpoints to an allowlist of trusted servers.

Patch Information

The fix is committed in FreeRDP commit 97f40b9 and merged via pull request #12873. The patch introduces 64-bit arithmetic and explicit bounds validation in avc444_ensure_buffer, and rejects zero-valued stride or padded height parameters before allocation.

Workarounds

Disable the RDPGFX AVC444 codec on the client where feasible, or use a non-H.264 decoder backend until patching is complete.
Route RDP traffic through a trusted gateway that terminates the graphics channel and rejects malformed surface commands.
Enforce user warnings and blocklists for connections to unknown RDP endpoints.

bash

# Verify installed FreeRDP version and prefer non-AVC444 graphics
xfreerdp --version
xfreerdp /v:<trusted-host> /gfx:AVC420 -gfx-h264