CVE-2026-55194 Overview
CVE-2026-55194 is a heap-based buffer overflow [CWE-122] in FreeRDP, an open source implementation of the Remote Desktop Protocol (RDP). The flaw resides in rpc_client_recv_fragment inside libfreerdp/core/gateway/rpc_client.c. The function sizes the response reassembly stream using only the server-declared alloc_hint field instead of the actual StubLength that will be written. A malicious Terminal Services (TS) Gateway can send a PTYPE_RESPONSE fragment with a small alloc_hint and a much larger frag_length, forcing Stream_Write to copy attacker-controlled stub data past the 4096-byte pdu->s buffer. FreeRDP versions prior to 3.27.0 are affected.
Critical Impact
A malicious RDP gateway can trigger heap corruption in the FreeRDP client, causing crashes and potentially enabling arbitrary code execution on the connecting user's machine.
Affected Products
- FreeRDP versions prior to 3.27.0
- Applications and distributions embedding vulnerable FreeRDP libraries
- RDP clients using libfreerdp gateway functionality (TS Gateway/RPC transport)
Discovery Timeline
- 2026-08-19 - CVE-2026-55194 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-55194
Vulnerability Analysis
FreeRDP's RPC-over-HTTP transport reassembles fragmented PTYPE_RESPONSE PDUs into a fixed 4096-byte stream buffer, pdu->s. The reassembly logic in rpc_client_recv_fragment grows the stream capacity based on the server-declared alloc_hint field, which represents the sender's estimate of the eventual payload size. However, the function does not validate that alloc_hint is at least as large as StubLength, the number of bytes actually copied from the current fragment.
When a malicious TS Gateway sends a fragment where alloc_hint is small but frag_length (and therefore StubLength) is large, Stream_Write copies attacker-controlled stub bytes beyond the allocated buffer. This corrupts adjacent heap memory. The result is a client-side heap overflow reachable over the network as soon as the FreeRDP client completes the RPC handshake with the rogue gateway.
Root Cause
The root cause is a missing length check between two independent server-controlled fields. The reassembly buffer is grown by alloc_hint while the write size is driven by StubLength derived from frag_length. Trusting alloc_hint for capacity planning without cross-checking the imminent write length allows the two values to disagree, producing a classic out-of-bounds write on the heap.
Attack Vector
Exploitation requires the victim to initiate an RDP connection through a TS Gateway controlled or influenced by the attacker. This includes attacker-operated gateways, DNS or routing redirection, and adversary-in-the-middle scenarios on the RDP path. Once the client connects, the attacker responds with a crafted PTYPE_RESPONSE PDU containing mismatched alloc_hint and frag_length values to trigger the overflow.
// Patch excerpt: libfreerdp/core/gateway/rpc_client.c
// Commit 9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a
// [core,gateway] ensure buffer size for current write
static int rpc_client_recv_fragment(rdpRpc* rpc, wStream* fragment)
{
int rc = -1;
- RPC_PDU* pdu = nullptr;
size_t StubOffset = 0;
size_t StubLength = 0;
RpcClientCall* call = nullptr;
Source: FreeRDP commit 9f2da52c. The full patch adjusts the reassembly logic to size the stream against the current StubLength rather than the server-declared alloc_hint.
Detection Methods for CVE-2026-55194
Indicators of Compromise
- FreeRDP client crashes or heap corruption signatures during or immediately after RPC-over-HTTP gateway negotiation
- Unexpected outbound RDP connections from user workstations to untrusted TS Gateway endpoints
- RPC fragments where frag_length significantly exceeds the advertised alloc_hint in captured RDP gateway traffic
Detection Strategies
- Inventory installed FreeRDP binaries and libraries across endpoints and flag any version below 3.27.0
- Inspect HTTPS traffic to /rpc/rpcproxy.dll and RPC-over-HTTP flows for malformed PTYPE_RESPONSE PDUs with inconsistent alloc_hint and frag_length fields
- Monitor process crash telemetry for freerdp, xfreerdp, wlfreerdp, and applications linking libfreerdp when connecting through gateways
Monitoring Recommendations
- Alert on FreeRDP client processes terminating abnormally with heap corruption or SIGSEGV faults
- Track RDP gateway destinations initiated by end-user hosts and baseline against approved gateway inventory
- Ingest endpoint and network telemetry into a centralized data lake to correlate client crashes with gateway session metadata
How to Mitigate CVE-2026-55194
Immediate Actions Required
- Upgrade FreeRDP to version 3.27.0 or later on every endpoint, container image, and packaged application shipping libfreerdp
- Restrict outbound RDP and RPC-over-HTTP traffic to a defined list of trusted TS Gateway hosts
- Rebuild and redistribute downstream products that statically link or bundle FreeRDP against the patched release
Patch Information
The issue is fixed in FreeRDP 3.27.0. The corrective change ensures the reassembly stream capacity accounts for the actual StubLength being written, not just the server-declared alloc_hint. Refer to FreeRDP release 3.27.0, GitHub Security Advisory GHSA-9gxm-3mf5-f5cx, and Pull Request #12873 for full details.
Workarounds
- Avoid connecting to RDP servers through untrusted or third-party TS Gateways until clients are patched
- Enforce egress filtering so that FreeRDP clients can only reach known-good gateway endpoints
- Where feasible, disable the RPC-over-HTTP gateway transport and use direct RDP or a VPN-fronted path instead
# Verify installed FreeRDP client version and upgrade path
xfreerdp --version
# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade freerdp2-x11 freerdp3-x11
# Fedora/RHEL
sudo dnf upgrade freerdp
# Confirm the runtime library is 3.27.0 or later
ldconfig -p | grep freerdp
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
