CVE-2026-55192: FreeRDP Buffer Overflow Vulnerability

CVE-2026-55192 Overview

CVE-2026-55192 is an out-of-bounds read vulnerability [CWE-125] in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). The flaw affects versions prior to 3.27.0 and resides in the H.264 decoder backends within libfreerdp/codec/h264.c. FreeRDP does not verify that the decoded YUV frame dimensions match the negotiated RDPGFX surface size. A malicious RDP server can send crafted AVC420 or AVC444 bitstreams whose decoded frames are smaller than the surface dimensions, causing yuv420_context_decode and YUV-to-RGB conversion routines to read beyond decoder-owned planes.

Critical Impact
A malicious RDP server can disclose client memory contents or crash the FreeRDP client through a crafted H.264 bitstream.

Affected Products

FreeRDP versions prior to 3.27.0
FreeRDP H.264 decoder backends (FFmpeg, MediaCodec)
Client applications built on FreeRDP libraries (libfreerdp)

Discovery Timeline

2026-08-19 - CVE-2026-55192 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-55192

Vulnerability Analysis

The vulnerability affects FreeRDP's handling of H.264 video streams used in RemoteFX Graphics Pipeline (RDPGFX) surface updates. When an RDP server transmits an AVC420 or AVC444 encoded bitstream, the H.264 decoder backends return YUV planes sized according to the decoded bitstream. FreeRDP uses these plane dimensions without validating them against the surface width and height previously negotiated during RDPGFX capability exchange.

When the decoded frame is smaller than the negotiated surface, the region rectangle validation still permits accesses covering the larger surface area. The yuv420_context_decode function and YUV-to-RGB conversion paths then iterate across coordinates that exceed the decoder-allocated buffers, reading adjacent process memory.

The consequences fall into two categories. First, the out-of-bounds read may disclose client process memory contents to be rendered on screen or reprocessed. Second, reads crossing unmapped memory pages crash the client process, producing a denial-of-service condition.

Root Cause

The root cause is missing validation between two independent size sources. The H.264 backend reports the actual decoded frame dimensions, while the RDPGFX layer maintains its own negotiated surface size. Prior to 3.27.0, libfreerdp/codec/h264.c and the FFmpeg and MediaCodec backends assumed both values were equivalent.

Attack Vector

Exploitation requires a victim to initiate an RDP connection to an attacker-controlled server. This aligns with the CVSS user interaction requirement. Once connected, the server negotiates a large RDPGFX surface, then transmits an H.264 bitstream that decodes to a smaller frame, triggering the out-of-bounds read in the client.

// Patch from libfreerdp/codec/h264_ffmpeg.c
// [codec,h264] ensure decoded frame size matches expectations
iStride[0] = (UINT32)MAX(0, sys->videoFrame->linesize[0]);
iStride[1] = (UINT32)MAX(0, sys->videoFrame->linesize[1]);
iStride[2] = (UINT32)MAX(0, sys->videoFrame->linesize[2]);

if (sys->videoFrame->width < WINPR_ASSERTING_INT_CAST(int64_t, h264->width))
    goto fail;
if (sys->videoFrame->height < WINPR_ASSERTING_INT_CAST(int64_t, h264->height))
    goto fail;
rc = 1;

Source: FreeRDP commit 0cd45b7. The patch rejects frames whose decoded dimensions are smaller than the expected h264->width and h264->height.

Detection Methods for CVE-2026-55192

Indicators of Compromise

FreeRDP client crashes or unexpected termination shortly after connecting to a remote RDP host
Client-side memory access violations logged during H.264 surface command processing
Outbound RDP connections to untrusted or newly registered destinations negotiating RDPGFX H.264 codecs

Detection Strategies

Inventory endpoints running FreeRDP-based clients and identify installed versions below 3.27.0
Monitor process telemetry for FreeRDP client crashes correlated with active RDP sessions
Inspect RDP session metadata for AVC420 and AVC444 codec negotiation to untrusted servers

Monitoring Recommendations

Alert on FreeRDP client processes generating segmentation faults or abnormal exits during active sessions
Log outbound TCP/3389 and TCP/443 RDP gateway connections and review destinations against threat intelligence
Track deployed FreeRDP versions across the fleet and flag hosts remaining below 3.27.0

How to Mitigate CVE-2026-55192

Immediate Actions Required

Upgrade all FreeRDP installations to version 3.27.0 or later
Rebuild and redistribute downstream applications that statically link libfreerdp
Restrict outbound RDP connections to a defined allowlist of trusted servers

Patch Information

The fix is available in FreeRDP Release 3.27.0. The patch is tracked in Pull Request #12873 and committed as 0cd45b7. Details are documented in GHSA-3mmf-qh4f-frm6. Both the FFmpeg backend (h264_ffmpeg.c) and the MediaCodec backend (h264_mediacodec.c) receive dimension validation checks that reject undersized decoded frames.

Workarounds

Disable the RDPGFX H.264 codec on the client where the command-line or configuration option is exposed, forcing fallback to legacy codecs
Only connect to known-trusted RDP servers until the upgrade to 3.27.0 is complete
Isolate FreeRDP client hosts on network segments that restrict connections to authorized RDP endpoints

bash

# Upgrade FreeRDP to the fixed release from source
git clone https://github.com/FreeRDP/FreeRDP.git
cd FreeRDP
git checkout 3.27.0
cmake -B build -S . -DCMAKE_BUILD_TYPE=Release
cmake --build build --parallel
sudo cmake --install build

# Verify the installed version
xfreerdp --version