Riskcovery

CVE-2026-55827

FreeRDP: Heap out-of-bounds write in RemoteFX (RFX) Cache Bitmap V3 decode

State
Published
Severity
7.5 High
Published
Jul 10, 2026
Updated
Jul 15, 2026
Reserved
Jun 17, 2026

Read the record on cve.org

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched with the non-default /cache:codec:rfx option pass desktop stride and height to RemoteFX decoding for Cache Bitmap V3 data while allocating bitmap->data only for the smaller DstWidth and DstHeight in gdi_Bitmap_Decompress, allowing a malicious RDP server to trigger a heap out-of-bounds write with attacker-controlled offset and content. This issue is fixed in version 3.27.1.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HGitHub_M

Weaknesses

  • CWE-131 Incorrect Calculation of Buffer Size
  • CWE-787 Out-of-bounds Write

Affected Products

ProductVersions
FreeRDPFreeRDP
  • < 3.27.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.