Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater than cache->number instead of greater than or equal to it. A malicious RDP server can use GLYPH_FRAGMENT_USE replay in update_process_glyph_fragments to make the default cache receive index 254 when cache->number is 254, reading one pointer beyond the entries array and dereferencing it as a glyph. This can crash the client and may disclose adjacent heap data. This issue is fixed in version 3.27.0.
Published: 2026-08-19
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an out‑of‑bounds read in the glyph_cache_get function of FreeRDP, caused by an incorrect comparison that allows an index equal to the maximum cache size to be accessed. When a malicious RDP server sends a crafted GLYPH_FRAGMENT_USE packet, the client may read a pointer beyond the glyph entries array, leading to application crash and possible leakage of adjacent heap data.

Affected Systems

FreeRDP implementations older than version 3.27.0 are affected. Any deployment using the FreeRDP library and connecting to remote servers without hard‑coded version checks can be impacted by this flaw.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity. Although the EPSS score is not available and the flaw is not listed in CISA’s KEV catalog, the attack requires control over the RDP server side, making exploitation practical for an adversary who can supply a malicious session to the client. The primary consequence is service disruption, with a secondary risk of exposing heap information for a local or remote attacker once the crash occurs.

Generated by OpenCVE AI on August 20, 2026 at 13:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the FreeRDP client to version 3.27.0 or later, which corrects the index check in glyph_cache_get.
  • If an immediate upgrade is not possible, apply the upstream patch from commit c29324750e3cbcba8761f147b7a5235cc686930f to address the off‑by‑one flaw.
  • Restrict FreeRDP client connections to trusted RDP servers only by using firewall rules or VPNs, thereby reducing the chance that a malicious server can trigger the vulnerability.

Generated by OpenCVE AI on August 20, 2026 at 13:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8561-1 FreeRDP vulnerabilities
History

Tue, 25 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 25 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Freerdp
Freerdp freerdp
Vendors & Products Freerdp
Freerdp freerdp

Wed, 19 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater than cache->number instead of greater than or equal to it. A malicious RDP server can use GLYPH_FRAGMENT_USE replay in update_process_glyph_fragments to make the default cache receive index 254 when cache->number is 254, reading one pointer beyond the entries array and dereferencing it as a glyph. This can crash the client and may disclose adjacent heap data. This issue is fixed in version 3.27.0.
Title FreeRDP: Out-of-bounds read in glyph_cache_get via crafted glyph fragments
Weaknesses CWE-125
CWE-193
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L'}

Subscriptions

Freerdp Freerdp
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-25T03:33:53.901Z

Reserved: 2026-06-16T23:11:20.214Z

Link: CVE-2026-55564

cve-icon Vulnrichment

Updated: 2026-08-25T03:33:46.503Z

cve-icon NVD

Status : Received

Published: 2026-08-19T18:16:45.003

Modified: 2026-08-25T04:18:12.497

Link: CVE-2026-55564

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-19T17:45:47Z

Links: CVE-2026-55564 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T13:15:03Z

Weaknesses