CVE-2026-55192 is a high severity (CVSS 8.2) out-of-bounds read in FreeRDP. A malicious RDP server can send an H.264 frame smaller than the negotiated surface, so the client reads past decoder buffers. It can disclose client memory or crash the client. Fixed in 3.27.0.
What's affected
- FreeRDP 3.26.0 and earlier. Fixed in 3.27.0.
The GitHub advisory limits the impact to clients that use RDPGFX with AVC420 or AVC444 and an H.264 decoder backend (FFmpeg, OpenH264 or MediaCodec). It notes that Media Foundation on Windows has only partial protection. FreeRDP server-only deployments and builds without H.264 support are not affected.
The record and advisory agree on the fix version.
How to check if you're exposed
Print the version of the client:
xfreerdp /version
Distribution packages and other clients matter too. Applications that link libfreerdp, such as remote desktop client programs, carry their own exposure, so list those as well. Check the package changelog, because distributions can backport fixes without a version change.
If you build FreeRDP yourself, check whether H.264 support was enabled. Builds without it are described as not affected.
What to do now
- Upgrade FreeRDP to 3.27.0 or later, or install a distribution package that lists this CVE as fixed.
- Update applications and container images that bundle or link libfreerdp.
- Connect only to RDP servers and gateways you trust until you have patched.
- Do not open connection files from unknown sources.
Why it matters
The record lists CWE-125, out-of-bounds read. The decoder backends return image planes sized from the data stream, and the code did not compare the decoded width and height to the surface dimensions used to check regions. A frame smaller than expected makes the conversion code read past the planes the decoder owns.
Here the attacker is the server, and the victim is the client. That reverses the usual picture of remote desktop risk. Users who connect to unknown servers, or to compromised ones, are the exposed group. The record does not mark this CVE as known exploited.
One practical difficulty is finding every copy. FreeRDP is a library as well as a command line client, so it can sit inside remote desktop tools, container images and appliance firmware that do not mention it by name. Start from an inventory of installed packages and bundled libraries, then look for libfreerdp. If you want a quick inventory of which libraries a project pulls in, the free in-browser dependency scan at gold.safeguard.sh/scan runs without an account. Where a vendor ships its own build, ask them for the date they picked up 3.27.0 or a backport.
Quick check
Who is the attacker in this flaw?
A malicious RDP server. The vulnerable code runs in the client.
Are builds without H.264 safe from this one?
The advisory says builds without H.264 support are not affected.
Sources
Last reviewed: 18 October 2026.
