CVE-2026-55191 is a critical flaw (CVSS 9.8) in FreeRDP clients before 3.27.0. A 32-bit multiplication in the AVC444 buffer sizing code can wrap, so a malicious RDP server can trigger a heap overflow that may crash the client or lead to code execution. Upgrade to FreeRDP 3.27.0.
What's affected
- FreeRDP 3.26.0 and earlier, and current master at the time of the report, per the advisory. The record says before 3.27.0.
- Fixed in 3.27.0.
- Clients that negotiate RDPGFX with AVC444 and use an H.264 decoder backend, typically built with FFmpeg. FreeRDP server-only deployments and builds without H.264 support are not affected, per the advisory.
How to check if you're exposed
Read the client version.
xfreerdp /version
Check distribution packages as well, because many tools embed libfreerdp, such as remote desktop clients and gateways. List them and check their versions. Then ask whether your build has H.264 support. If it was built without it, the advisory says you are not affected.
What to do now
- Upgrade FreeRDP to 3.27.0 or later, or install the distribution package that includes the fix.
- Update applications that bundle libfreerdp and rebuild container images that include it.
- Connect only to RDP servers you trust until you have updated.
- Check for H.264 support in your build, and note that disabling it changes the exposure.
Why it matters
The classes are CWE-122, CWE-190: heap-based buffer overflow, and integer overflow or wraparound. The advisory shows the buffer size computed with 32-bit arithmetic. When the true product exceeds the 32-bit limit it wraps to a small nonzero number, passes the only check, and a too-small buffer is allocated. Later code writes using the real dimensions.
The direction of the attack is notable. Here the client is the target and the malicious party is the server. The record does not mark the CVE as exploited in the wild. The maintainers fixed the sizing calculation in commit 97f40b9.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is the RDP server I run at risk?
The advisory says server-only deployments that do not run the client side decompression are not affected. The risk is to clients connecting to a malicious server.
Sources
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vx73-w5q6-7jqr
- https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0
- https://github.com/FreeRDP/FreeRDP/commit/97f40b9e766af375f4e41ac6a3f4397d708d249c
Last reviewed: 19 October 2026.
