CVE-2026-55191

FreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocation

Published Aug 19, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444_ensure_buffer. A malicious RDP server can supply surface dimensions for which piDstStride multiplied by padDstHeight wraps to a small nonzero value, causing winpr_aligned_recalloc to allocate an undersized buffer before YUV420CombineToYUV444 writes using the actual stride and rectangle dimensions. This can cause a client crash and may permit code execution through attacker-influenced heap corruption. This issue is fixed in version 3.27.0.

Analysis

Technical impact

FreeRDP clients that negotiate the RDPGFX AVC444 format with an H.264 backend compute an intermediate YUV444 buffer size using 32‑bit multiplication in avc444_ensure_buffer. If an attacker‑controlled RDP server supplies surface dimensions that cause the stride multiplied by the height to wrap to a small nonzero value, the calculated buffer size becomes undersized. The subsequent YUV420CombineToYUV444 write then overflows the heap, which can crash the client and potentially corrupt heap memory to enable arbitrary code execution.

Affected Systems

All FreeRDP clients before version 3.27.0 that support RDPGFX AVC444 with an H.264 decoder are affected. The vulnerability is mitigated in the 3.27.0 release, which adjusts the buffer size calculations to use safe arithmetic.

Risk and Exploitability

The flaw carries a CVSS score of 8.7 and is not listed in the CISA KEV catalog. The EPSS score is < 1%, indicating a very low exploitation probability, but exploitation requires only the ability to act as an RDP server and to send crafted surface dimensions, making it a remotely exploitable issue that could lead to code execution if heap corruption is achieved.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

FreeRDP

affected

Version	Status	Constraints
`< 3.27.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Freerdp

Version	Status	Scheme	Platform
`[0,3.27.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade FreeRDP to version 3.27.0 or later, which corrects the buffer size calculation.
If an upgrade cannot be performed immediately, disable the RDPGFX AVC444 feature or the H.264 backend to prevent the vulnerable code path from being executed.
Validate or restrict surface dimensions supplied by remote servers, or implement server-side checks to ensure dimensions are within expected bounds.

Generated by OpenCVE AI on August 25, 2026 at 14:09 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8561-1	FreeRDP vulnerabilities

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.619% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/FreeRDP/FreeRDP/commit/97f40b9e766af375f4e41ac6a3f4397d708d249c
https://github.com/FreeRDP/FreeRDP/pull/12873
https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vx73-w5q6-7jqr
https://nvd.nist.gov/vuln/detail/CVE-2026-55191
https://www.cve.org/CVERecord?id=CVE-2026-55191

History

Sep 22, 2026 8:00 PM Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:freerdp:freerdp::::::::
Metrics	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Aug 25, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://nvd.nist.gov/vuln/detail/CVE-2026-55191 https://www.cve.org/CVERecord?id=CVE-2026-55191
Metrics	threat_severity `None`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Aug 19, 2026 8:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Freerdp Freerdp freerdp
Vendors & Products		Freerdp Freerdp freerdp

Aug 19, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 19, 2026 6:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444_ensure_buffer. A malicious RDP server can supply surface dimensions for which piDstStride multiplied by padDstHeight wraps to a small nonzero value, causing winpr_aligned_recalloc to allocate an undersized buffer before YUV420CombineToYUV444 writes using the actual stride and rectangle dimensions. This can cause a client crash and may permit code execution through attacker-influenced heap corruption. This issue is fixed in version 3.27.0.
Title		FreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocation
Weaknesses		CWE-122 CWE-190
References		https://github.com/FreeRDP/FreeRDP/commit/97f40b9e766af375f4e41ac6a3f4397d708d249c https://github.com/FreeRDP/FreeRDP/pull/12873 https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vx73-w5q6-7jqr
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`