CVE-2026-55192: freerdp Out-of-bounds Read
Vulnerability summary
CVE-2026-55192 is a high (CVSS 8.2) Out-of-bounds Read vulnerability in freerdp. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 37.7% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 4 · Related 2Timeline
- 19-08-2026PublishedVulnerability first disclosed.
- 25-08-2026Last modifiedVulnerability information updated.
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder backends can return YUV planes sized from the bitstream without comparing the decoded width and height to the RDPGFX surface dimensions used to validate region rectangles. A malicious RDP server can provide an AVC420 or AVC444 bitstream whose decoded frame is smaller than the negotiated surface, causing yuv420_context_decode and the YUV-to-RGB conversion paths to read beyond the decoder-owned planes in libfreerdp/codec/h264.c and the selected H.264 backend. This can disclose client memory or crash the client. This issue is fixed in version 3.27.0.
CVSS metrics
6 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.2HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
- NVDNIST7.2HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
- OSV · DebianEcosystem advisory · calculated8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
EPSS trend
Probability
0.45%
Chance of exploitation in the next 30 days
Percentile
38%
Versus all other CVEs
30-day change
-0.05 pp
From 0.50% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundFreerdp
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Ubuntu3 products
- freerdpAll versions (No fix recorded)
- freerdp2All versions (No fix recorded)
- freerdp3< 3.30.0+dfsg-0ubuntu0.24.04.1 | All versions (No fix recorded) | < 3.30.0+dfsg-0ubuntu0.26.04.1
Debian2 products
- freerdp2All versions (No fix recorded)
- freerdp3All versions (No fix recorded) | < 3.27.0+dfsg-1
Freerdp1 product
- freerdp< 3.27.0
3 vendors · 6 products
References
8 links- github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mmf-qh4f-frm6X Refsource CONFIRMREPORTExploitMitigationVendor Advisory
