CVE-2026-55564 is a medium severity (CVSS 5.4) out-of-bounds read in FreeRDP. The glyph_cache_get function checks the index with greater than instead of greater than or equal to, so a malicious RDP server can make the client read one pointer past an array. Fixed in 3.27.0.
What's affected
- FreeRDP 3.26.0 and earlier. Fixed in 3.27.0.
The advisory notes the flaw was still present in 3.25.0 and in the main branch when reported. It describes the issue as the read-side twin of an older write-side bug fixed in 2.1.2, where the sibling put function already used the correct check.
The record and advisory agree on the fix version.
How to check if you're exposed
Print the version of the client:
xfreerdp /version
Distribution packages and other clients matter too. Applications that link libfreerdp, such as remote desktop client programs, carry their own exposure, so list those as well. Check the package changelog, because distributions can backport fixes without a version change.
What to do now
- Upgrade FreeRDP to 3.27.0 or later, or install a distribution package that lists this CVE as fixed.
- Update applications and container images that bundle or link libfreerdp.
- Connect only to RDP servers and gateways you trust until you have patched.
- Do not open connection files from unknown sources.
Why it matters
The record lists CWE-125, out-of-bounds read, and CWE-193, off-by-one error. The cache's entries array holds exactly the number of pointers it was created with. An index equal to that number passes the check, reads one slot past the end, and the caller then treats that slot as a glyph. The fix changes the comparison to include the equal case.
The advisory says this can crash the client and may disclose adjacent heap data. Off-by-one bugs are easy to write and easy to miss in review, especially when a sibling function has the right check. The record does not mark this CVE as known exploited.
One practical difficulty is finding every copy. FreeRDP is a library as well as a command line client, so it can sit inside remote desktop tools, container images and appliance firmware that do not mention it by name. Start from an inventory of installed packages and bundled libraries, then look for libfreerdp. If you want a quick inventory of which libraries a project pulls in, the free in-browser dependency scan at gold.safeguard.sh/scan runs without an account. Where a vendor ships its own build, ask them for the date they picked up 3.27.0 or a backport.
Quick check
What is an off-by-one error?
A boundary check that is wrong by exactly one, here a comparison that allows an index equal to the array size.
Why is the score lower than the other FreeRDP issues?
The impact is a one-slot read, with lower confidentiality and availability impact than the overflow issues fixed in the same release.
Sources
Last reviewed: 18 October 2026.
