CVE-2026-55193 is a high severity (CVSS 8.8) heap buffer overflow in FreeRDP. A client that connects through a TS Gateway accepts a server-controlled fragment size without bounding it. A malicious gateway can crash the client and may achieve code execution. Fixed in 3.27.0.
What's affected
- FreeRDP 3.26.0 and earlier. Fixed in 3.27.0.
The advisory limits exposure to clients using TS Gateway or RD Gateway transport, such as xfreerdp with the gateway options. Direct RDP connections that do not use the gateway RPC layer, and server-only deployments, are not affected.
The record and the advisory agree on the fix version.
How to check if you're exposed
Print the version of the client:
xfreerdp /version
Distribution packages and other clients matter too. Applications that link libfreerdp, such as remote desktop client programs, carry their own exposure, so list those as well. Check the package changelog, because distributions can backport fixes without a version change.
Then check whether any of your users or scripts connect through a gateway. If nobody does, your exposure to this one is lower.
What to do now
- Upgrade FreeRDP to 3.27.0 or later, or install a distribution package that lists this CVE as fixed.
- Update applications and container images that bundle or link libfreerdp.
- Connect only to RDP servers and gateways you trust until you have patched.
- Do not open connection files from unknown sources.
- Review which gateways your clients use and make sure they are ones your organization controls.
Why it matters
The record lists CWE-122, heap based buffer overflow. During the RPC bind step the client accepts a maximum fragment size from the gateway. The receive buffer is a fixed 4088 bytes, but the advertised value can be as high as 65535. If the gateway then sends a fragment of that size, the read writes beyond the buffer.
The advisory says this can crash the client and may permit code execution through heap corruption. The attacker has to be the gateway the client connects to, so trust in that gateway matters. The record does not mark this CVE as known exploited.
One practical difficulty is finding every copy. FreeRDP is a library as well as a command line client, so it can sit inside remote desktop tools, container images and appliance firmware that do not mention it by name. Start from an inventory of installed packages and bundled libraries, then look for libfreerdp. If you want a quick inventory of which libraries a project pulls in, the free in-browser dependency scan at gold.safeguard.sh/scan runs without an account. Where a vendor ships its own build, ask them for the date they picked up 3.27.0 or a backport.
Quick check
Does a direct RDP connection avoid this?
The advisory says direct connections that do not use the gateway RPC layer are not affected.
What is the root cause in one line?
The client trusts a size value from the gateway and uses it to read into a smaller fixed buffer.
Sources
Last reviewed: 18 October 2026.
