CVE-2026-55648: FreeRDP Buffer Overflow Vulnerability

CVE-2026-55648 Overview

CVE-2026-55648 is an integer overflow vulnerability in FreeRDP, the open-source implementation of the Remote Desktop Protocol (RDP). The flaw resides in freerdp_image_copy_from_icon_data within libfreerdp/codec/color.c. The function calculates required buffer size as nWidth * nHeight * FreeRDPGetBytesPerPixel(format) using 32-bit arithmetic. A malicious RDP server can send a Remote Application Integrated Locally (RAIL) TS_ICON_INFO update with dimensions such as 32768 by 32768 at 32 bits per pixel, causing the multiplication to wrap. The wrapped value bypasses the cbBitsColor bounds check before freerdp_image_copy_no_overlap reads attacker-controlled icon data. RemoteApp clients using the vulnerable library path are affected. The xfreerdp client has a caller-side mitigation. The issue is fixed in version 3.27.0.

Critical Impact
A malicious RDP server can trigger an out-of-bounds read in RemoteApp clients by exploiting a 32-bit integer overflow in icon dimension calculations, leading to memory disclosure or process crash.

Affected Products

FreeRDP versions prior to 3.27.0
RemoteApp clients built against the vulnerable libfreerdp library path
Applications embedding FreeRDP for RAIL (Remote Application Integrated Locally) support

Discovery Timeline

2026-08-19 - CVE-2026-55648 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-55648

Vulnerability Analysis

The vulnerability is a classic integer overflow [CWE-190] in the icon data validation path. FreeRDP processes TS_ICON_INFO updates sent by an RDP server as part of the RAIL protocol extension. Before copying pixel data, freerdp_image_copy_from_icon_data computes the expected byte size of the incoming icon and compares it against cbBitsColor, the declared source buffer length.

The multiplication nWidth * nHeight * FreeRDPGetBytesPerPixel(format) is performed in 32-bit unsigned arithmetic. With attacker-controlled dimensions of 32768 by 32768 at 4 bytes per pixel, the true product is 4,294,967,296, which wraps to 0. Any small cbBitsColor value then passes the bounds check.

The downstream call to freerdp_image_copy_no_overlap uses the original nWidth and nHeight to read pixels, causing an out-of-bounds read well beyond the actual source buffer. The attacker controls dimensions, pixel format, and buffer content, enabling memory disclosure or client crash.

Root Cause

The root cause is missing overflow protection when computing a required buffer size from untrusted network inputs. The check cbBitsColor < nWidth * nHeight * bpp fails to account for arithmetic wraparound in the 32-bit result.

Attack Vector

Exploitation requires a victim to connect a vulnerable RemoteApp client to a malicious or compromised RDP server. User interaction is required to initiate the connection. Once connected, the server sends a crafted TS_ICON_INFO RAIL message with oversized dimensions to trigger the overflow.

 	}
 
 	/* Ensure we have enough source data bytes for image copy. */
-	if (cbBitsColor < nWidth * nHeight * FreeRDPGetBytesPerPixel(format))
+	if (cbBitsColor / nHeight < FreeRDPGetBytesPerPixel(format) * nWidth)
 	{
 		WLog_ERR(TAG,
 		         "cbBitsColor{%" PRIu32 "} < nWidth{%" PRIu32 "} * nHeight{%" PRIu32

The patch rewrites the check as a division, avoiding the multiplication overflow. Source: FreeRDP Commit e4ae473.

Detection Methods for CVE-2026-55648

Indicators of Compromise

Outbound RDP connections from user workstations to untrusted or newly registered external hosts on TCP 3389
RemoteApp client crashes or unexpected process termination shortly after connecting to a remote RDP endpoint
WLog_ERR messages from FreeRDP referencing cbBitsColor bounds violations in application logs
RAIL TS_ICON_INFO messages carrying dimensions at or near UINT16_MAX (for example 32768x32768)

Detection Strategies

Inventory endpoints running FreeRDP-based RemoteApp clients and identify versions below 3.27.0
Inspect RDP session telemetry for anomalous outbound connections initiated by RemoteApp client processes
Monitor for crash dumps of processes linked against libfreerdp and correlate with recent RDP session activity
Alert on any RAIL icon update with width or height exceeding reasonable UI values (typically 256 pixels)

Monitoring Recommendations

Forward FreeRDP application logs and crash telemetry to a centralized log platform for correlation
Track process creation events for RemoteApp clients and their parent-child chains after connection attempts
Baseline typical RDP client destinations and alert on connections to unapproved external servers

How to Mitigate CVE-2026-55648

Immediate Actions Required

Upgrade all FreeRDP installations and any applications embedding libfreerdp to version 3.27.0 or later
Rebuild and redistribute downstream RemoteApp clients that statically or dynamically link against FreeRDP
Restrict outbound RDP connections from user endpoints to a defined allowlist of trusted internal servers
Warn users to avoid connecting RemoteApp clients to untrusted or unknown RDP endpoints

Patch Information

The fix is available in FreeRDP 3.27.0. The patch is tracked in Pull Request 12877 and documented in GHSA-5c5v-f78v-h2f6. The corrected check divides cbBitsColor by nHeight before comparing to the per-row byte count, eliminating the overflow condition.

Workarounds

Use xfreerdp, which contains a caller-side mitigation, until vulnerable RemoteApp clients can be patched
Enforce network egress policies that restrict RDP traffic to trusted internal RDP hosts only
Disable or block RAIL (RemoteApp) functionality where it is not required by the business

bash

# Example egress restriction limiting RDP to a trusted subnet
iptables -A OUTPUT -p tcp --dport 3389 -d 10.10.20.0/24 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 3389 -j DROP