CVE-2026-55194: Heap Overflow in FreeRDP TS Gateway Client

CVE-2026-55194 is a critical heap overflow (CVSS 9.8) in FreeRDP clients before 3.27.0 that connect through a TS Gateway. The reassembly code sizes its buffer from a server declared hint, so a malicious gateway can write past a 4096 byte buffer. It can crash the client and may allow code execution. Upgrade to 3.27.0.

What's affected

• FreeRDP 3.26.0 and earlier, and current master at the time of the report, per the advisory. The record says before 3.27.0.
• Fixed in 3.27.0.
• Clients that use TS Gateway or RD Gateway transport. Direct RDP connections that avoid the gateway RPC layer, and server-only deployments, are not affected, per the advisory.

How to check if you're exposed

Read the client version.

xfreerdp /version

Then find where your users connect through a gateway. In FreeRDP command lines that is the gateway option, and in GUI tools it is a gateway field. Also list tools that embed libfreerdp, and check each one.

What to do now

1. Upgrade FreeRDP to 3.27.0 or later, or install the package from your distribution that includes the fix.
2. Update software that bundles libfreerdp.
3. Connect through gateways you operate and trust.
4. Prefer direct connections to known servers if that is workable, until you have updated.

Why it matters

The class is CWE-122, heap-based buffer overflow. The advisory says the client ensured capacity from the server declared allocation hint only. It did not look at the offset it was writing at, or at the actual length of the data it was about to copy. A small hint with a large fragment left the buffer at its original size while a long copy ran past it.

The rule is to size from the data you are about to copy, never from a number the peer supplied separately. The record does not mark the CVE as exploited in the wild. The fix is in commit 9f2da52, and the release 3.27.0 also fixes CVE-2026-55191.

For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.

Quick check

Sources

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9gxm-3mf5-f5cx
• https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0
• https://github.com/FreeRDP/FreeRDP/commit/9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a

Last reviewed: 19 October 2026.