CVE-2026-55648 is a high severity (CVSS 7.5) integer overflow in FreeRDP. In RemoteApp mode, a malicious server can send icon dimensions that make a size calculation wrap, bypassing a bounds check. Clients that use the library path are affected. Fixed in 3.27.0.
What's affected
- FreeRDP 3.26.0 and earlier. Fixed in 3.27.0.
The advisory says clients running RAILS or RemoteApp mode are affected, and desktop mode sessions are not. It also states that xfreerdp is not affected because a caller-side mitigation is in place. Other clients that use the same library function may be.
The record says prior to 3.27.0, which agrees with the advisory on the fix.
How to check if you're exposed
Print the version of the client:
xfreerdp /version
Distribution packages and other clients matter too. Applications that link libfreerdp, such as remote desktop client programs, carry their own exposure, so list those as well. Check the package changelog, because distributions can backport fixes without a version change.
Then find out which of your tools use RemoteApp. Third-party clients that link libfreerdp and enable RemoteApp are the ones to look at, since the advisory says xfreerdp has its own guard.
What to do now
- Upgrade FreeRDP to 3.27.0 or later, or install a distribution package that lists this CVE as fixed.
- Update applications and container images that bundle or link libfreerdp.
- Connect only to RDP servers and gateways you trust until you have patched.
- Do not open connection files from unknown sources.
Why it matters
The record lists CWE-190, integer overflow. The function freerdp_image_copy_from_icon_data multiplies width, height and bytes per pixel in 32-bit arithmetic. For large values the product wraps around, so the check that the source buffer is big enough passes when it should fail. Later code then reads from a buffer that is smaller than assumed.
Integer overflow in a size check is one of the classic ways a bounds check ends up meaningless. Using wider arithmetic or checking for overflow before multiplying is the usual fix. The record does not mark this CVE as known exploited.
One practical difficulty is finding every copy. FreeRDP is a library as well as a command line client, so it can sit inside remote desktop tools, container images and appliance firmware that do not mention it by name. Start from an inventory of installed packages and bundled libraries, then look for libfreerdp. If you want a quick inventory of which libraries a project pulls in, the free in-browser dependency scan at gold.safeguard.sh/scan runs without an account. Where a vendor ships its own build, ask them for the date they picked up 3.27.0 or a backport.
Quick check
Is xfreerdp affected?
The advisory says xfreerdp is not affected because of a caller-side mitigation. Other clients using the library function may be.
Are normal desktop sessions affected?
The advisory says desktop mode sessions are not affected. The path is RAILS or RemoteApp mode.
Sources
Last reviewed: 18 October 2026.
