CVE-2026-55193: FreeRDP Buffer Overflow Vulnerability

CVE-2026-55193 Overview

CVE-2026-55193 is a heap-based buffer overflow [CWE-122] in FreeRDP, an open source implementation of the Remote Desktop Protocol (RDP). FreeRDP clients that connect through the Terminal Services (TS) Gateway trust a server-controlled max_xmit_frag value read in libfreerdp/core/gateway/rpc_bind.c. The client fails to bound this value against the fixed 4088-byte ReceiveFragment allocation. A malicious gateway can advertise a fragment size of 65535 and then send a response fragment of the same length. The oversized read triggers a heap overflow in rpc_channel_read inside libfreerdp/core/gateway/rpc.c. Version 3.27.0 fixes the flaw.

Critical Impact
A malicious TS Gateway server can crash FreeRDP clients and may achieve remote code execution through attacker-controlled heap corruption on the connecting client.

Affected Products

FreeRDP versions prior to 3.27.0
FreeRDP clients using TS Gateway (RPC over HTTP) transport
Applications and distributions that embed the vulnerable FreeRDP client libraries

Discovery Timeline

2026-08-19 - CVE-2026-55193 published to the National Vulnerability Database
2026-08-19 - Last updated in NVD database
3.27.0 - FreeRDP releases patched version, see GitHub Release 3.27.0

Technical Details for CVE-2026-55193

Vulnerability Analysis

FreeRDP's TS Gateway transport uses DCE/RPC framing over HTTP to tunnel RDP traffic. During the RPC bind handshake, the server returns a bind_ack PDU containing max_xmit_frag and max_recv_frag fields. The client stores these values and uses them to size subsequent read operations. The client also allocates a fixed-size ReceiveFragment buffer of 4088 bytes to hold inbound fragments.

Before the fix, rpc_recv_bind_ack_pdu accepted any 16-bit fragment size the server advertised, including the maximum value of 65535. The subsequent read in rpc_channel_read (libfreerdp/core/gateway/rpc.c) uses the negotiated size as the destination length, writing up to 65535 bytes into a 4088-byte heap allocation. The overflow corrupts adjacent heap metadata and objects, providing a primitive that ranges from process crash to arbitrary code execution depending on heap layout.

Root Cause

The root cause is missing validation of server-supplied protocol parameters against a locally enforced maximum. rpc_bind.c did not compare max_xmit_frag or max_recv_frag against the size of the ReceiveFragment allocation before assigning them to rpc->max_recv_frag and rpc->max_xmit_frag.

Attack Vector

Exploitation requires the victim to initiate an RDP connection through an attacker-controlled or compromised TS Gateway. User interaction is required to trigger the connection. Once the client reaches the RPC bind step, the malicious gateway returns a crafted PTYPE_BIND_ACK PDU with max_xmit_frag=0xFFFF, followed by an oversized fragment that overflows the client heap buffer.

// Patch: libfreerdp/core/gateway/rpc_bind.c
// [core,gateway] rpc header max fragment size checks
	WLog_DBG(TAG, header.common.ptype == PTYPE_BIND_ACK ? "Receiving BindAck PDU"
	                                                    : "Receiving AlterContextResp PDU");

	const UINT16 MAX_VALID_FRAG = 0x0FF8;
	if ((header.bind_ack.max_xmit_frag > MAX_VALID_FRAG) ||
	    (header.bind_ack.max_recv_frag > MAX_VALID_FRAG))
	{
		WLog_ERR(TAG,
		         "bind_ack: invalid fragment size: max_xmit_frag=%" PRIu16
		         ", max_recv_frag=%" PRIu16 ", maximum=%" PRIu16,
		         header.bind_ack.max_xmit_frag, header.bind_ack.max_recv_frag, MAX_VALID_FRAG);
		goto fail;
	}

	rpc->max_recv_frag = header.bind_ack.max_xmit_frag;
	rpc->max_xmit_frag = header.bind_ack.max_recv_frag;

Source: FreeRDP commit a863ef1. The patch introduces MAX_VALID_FRAG = 0x0FF8 (4088) and rejects any bind_ack that advertises a larger fragment size.

Detection Methods for CVE-2026-55193

Indicators of Compromise

Unexpected crashes of FreeRDP-based clients such as xfreerdp, wlfreerdp, or embedded RDP viewers immediately after establishing a TS Gateway connection
Outbound RPC-over-HTTP connections from workstations to unfamiliar TS Gateway hosts on TCP/443
FreeRDP process memory dumps showing corruption near the ReceiveFragment heap region

Detection Strategies

Inventory FreeRDP builds across managed endpoints and flag any version below 3.27.0
Inspect RPC bind_ack PDUs on gateway paths for max_xmit_frag or max_recv_frag values exceeding 4088 (0x0FF8)
Alert on FreeRDP client crashes that correlate with RPC-over-HTTP sessions in EDR telemetry

Monitoring Recommendations

Log and review outbound RDP-over-HTTPS connections initiated by end-user hosts to non-corporate gateways
Correlate FreeRDP client process termination events with preceding network sessions to identify suspicious gateway destinations
Monitor package manager activity to confirm distribution updates to FreeRDP 3.27.0 or later are applied

How to Mitigate CVE-2026-55193

Immediate Actions Required

Upgrade all FreeRDP client installations to version 3.27.0 or later
Rebuild and redistribute any downstream applications that statically link or vendor the FreeRDP libraries
Restrict client connections to trusted, corporate-operated TS Gateway hosts through firewall or proxy policy

Patch Information

The fix is available in FreeRDP 3.27.0 and is tracked in GHSA-7rp4-66mc-j9vx. The change is implemented in pull request #12873 and commit a863ef1, which enforces a MAX_VALID_FRAG of 4088 bytes on both max_xmit_frag and max_recv_frag in bind_ack PDUs.

Workarounds

Avoid using the TS Gateway (/g: option in xfreerdp) until the client is upgraded
Enforce egress restrictions so that clients only reach approved gateway endpoints under organizational control
Warn users against connecting to RDP gateways provided through email links, shared configuration files, or untrusted third parties

bash

# Verify installed FreeRDP client version
xfreerdp --version

# Debian/Ubuntu: upgrade the freerdp3 package
sudo apt update && sudo apt install --only-upgrade freerdp3-x11 libfreerdp3

# Fedora/RHEL: upgrade the freerdp package
sudo dnf upgrade freerdp

# Confirm the client reports version 3.27.0 or later
xfreerdp --version | grep -E '3\.(2[7-9]|[3-9][0-9])'