CVE-2026-55564: FreeRDP Buffer Overflow Vulnerability

CVE-2026-55564 Overview

CVE-2026-55564 is an out-of-bounds read vulnerability [CWE-125] in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). The flaw resides in the glyph_cache_get function within libfreerdp/cache/glyph.c. A malicious RDP server can send crafted GLYPH_FRAGMENT_USE replay data through update_process_glyph_fragments to force the client to read one pointer beyond the glyph cache entries array and dereference it. The result is a client crash and potential disclosure of adjacent heap memory. The issue affects FreeRDP versions prior to 3.27.0 and is resolved in 3.27.0.

Critical Impact
A malicious RDP server can crash a connecting FreeRDP client and leak adjacent heap data through an out-of-bounds pointer dereference in the glyph cache.

Affected Products

FreeRDP versions prior to 3.27.0
Applications and distributions bundling vulnerable FreeRDP client libraries
Remote desktop clients built on libfreerdp (for example, xfreerdp, wlfreerdp)

Discovery Timeline

2026-08-19 - CVE-2026-55564 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-55564

Vulnerability Analysis

The FreeRDP glyph cache stores pointers to cached glyph objects in a fixed-size array whose valid indices range from 0 to cache->number - 1. The glyph_cache_get function validated the index against the wrong boundary. It rejected values strictly greater than cache->number, allowing an index equal to cache->number to pass. That index reads one entry past the end of the array and returns whatever pointer value happens to sit in adjacent heap memory. The function then dereferences that value as a glyph pointer.

An attacker controlling the RDP server side can trigger this condition using a GLYPH_FRAGMENT_USE replay path inside update_process_glyph_fragments. When the default cache has number == 254, the server can supply index 254, which is exactly one past the last valid entry. The out-of-bounds pointer read leads to a client-side crash and may leak adjacent heap contents to attacker-observable state.

Root Cause

The root cause is an off-by-one bounds check. The original code used if (index > cache->number) where a correct check requires if (index >= cache->number). Because arrays in C are zero-indexed, treating cache->number as a valid index reads past the allocated entries.

Attack Vector

Exploitation requires the victim to initiate an RDP connection to an attacker-controlled or compromised server. No authentication on the client side is needed beyond the user-initiated connection. The attack vector is network-based with user interaction, and impact is limited to confidentiality of adjacent memory and client availability.

// Source: https://github.com/FreeRDP/FreeRDP/commit/c29324750e3cbcba8761f147b7a5235cc686930f
// Patch in libfreerdp/cache/glyph.c - [cache,glyph] tighten bounds checks
	GLYPH_CACHE* cache = &glyphCache->glyphCache[id];
-	if (index > cache->number)
+	if (index >= cache->number)
 	{
 		WLog_ERR(TAG, "index %" PRIu32 " out of range for cache id: %" PRIu32 "", index, id);
 		return nullptr;

The fix changes the comparison from > to >=, ensuring an index equal to cache->number is rejected before the array access.

Detection Methods for CVE-2026-55564

Indicators of Compromise

Unexpected termination or segmentation faults in FreeRDP-based clients (xfreerdp, wlfreerdp, or embedded consumers of libfreerdp) shortly after connecting to a remote host
Outbound RDP (TCP/3389) sessions to hosts outside sanctioned RDP infrastructure
Core dumps referencing glyph_cache_get or update_process_glyph_fragments in the call stack

Detection Strategies

Inventory endpoints and packages that ship libfreerdp and flag versions older than 3.27.0
Alert on RDP client crashes correlated with outbound RDP sessions to untrusted destinations
Inspect RDP session logs for repeated glyph cache errors emitted by WLog_ERR after the patch is deployed

Monitoring Recommendations

Monitor outbound RDP traffic and restrict it to known-good destinations via egress policy
Collect and centralize application crash telemetry from Linux and Windows workstations using FreeRDP
Track FreeRDP package versions across managed hosts and alert on downgrade or drift below 3.27.0

How to Mitigate CVE-2026-55564

Immediate Actions Required

Upgrade FreeRDP to version 3.27.0 or later on all affected clients and applications
Rebuild and redistribute any downstream software statically or dynamically linking libfreerdp
Restrict outbound RDP connections from user endpoints to trusted RDP gateways only

Patch Information

The issue is fixed in FreeRDP 3.27.0. The upstream fix is available in the GitHub commit c2932475 and merged via pull request #12885. Full release notes are documented in the FreeRDP 3.27.0 release, and additional context is provided in the GitHub Security Advisory GHSA-6xmj-pr98-cx4c.

Workarounds

Avoid connecting to untrusted or unknown RDP servers until clients are upgraded
Route RDP sessions through an authenticated RDP gateway that validates the destination
Use network segmentation to block direct outbound TCP/3389 from user workstations

bash

# Verify installed FreeRDP client version and upgrade
xfreerdp --version

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade freerdp2-x11 freerdp3-x11

# Fedora/RHEL
sudo dnf upgrade freerdp

# Build from source at the fixed release
git clone --branch 3.27.0 https://github.com/FreeRDP/FreeRDP.git