8.8

CVE-2026-55193: freerdp Heap-based Buffer Overflow

CVSS: 8.8v3.1HighAnalyzed
AliasesRHSA-2026:66347RHSA-2026:66349RHSA-2026:69387
Published 19-08-2026Last modified 27-08-2026
Open JSON

Vulnerability summary

CVE-2026-55193 is a high (CVSS 8.8) Heap-based Buffer Overflow vulnerability in freerdp. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 37.5% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
45/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (NVD)
EPSS score
0.45%
0%100%
Low · -0.04 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 4 · Related 2
MGASA-2026-0383OPENSUSE-SU-2026:11065-1RHSA-2026:74471USN-8561-1

Timeline

  1. 19-08-2026
    PublishedVulnerability first disclosed.
  2. 27-08-2026
    Last modifiedVulnerability information updated.

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled max_xmit_frag value in libfreerdp/core/gateway/rpc_bind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise 65535 and then send a response fragment of the same length, causing rpc_channel_read in libfreerdp/core/gateway/rpc.c to write up to 65535 bytes into the smaller ReceiveFragment buffer. This can crash the client and may permit code execution through attacker-controlled heap corruption. This issue is fixed in version 3.27.0.

CVSS metrics

7 scores · 5 sources · 2 versions

EPSS trend

Probability

0.45%

Chance of exploitation in the next 30 days

Percentile

38%

Versus all other CVEs

30-day change

-0.04 pp

From 0.49% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.45%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Freerdp

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Redhat11 products
  • freerdp< 2:2.11.7-1.el9_6.14 | < 2:2.11.2-1.el9_4.12 | < 2:2.2.0-14.el8_4.4 | < 2:2.2.0-7.el8_6.13 | < 2:2.2.0-12.el8_8.12 | < 2:2.4.1-6.el9_2.13 | < 0:2.1.1-5.el7_9.13 | < 2:2.11.7-7.el9_8.7 | < 2:3.10.3-12.el10_2.11 | < 2:2.11.7-13.el8_10
  • freerdp-debuginfo< 2:2.11.7-1.el9_6.14 | < 2:2.11.2-1.el9_4.12 | < 2:2.2.0-14.el8_4.4 | < 2:2.2.0-7.el8_6.13 | < 2:2.2.0-12.el8_8.12 | < 2:2.4.1-6.el9_2.13 | < 0:2.1.1-5.el7_9.13 | < 2:2.11.7-7.el9_8.7 | < 2:3.10.3-12.el10_2.11 | < 2:2.11.7-13.el8_10
  • freerdp-debugsource< 2:2.11.7-1.el9_6.14 | < 2:2.11.2-1.el9_4.12 | < 2:2.2.0-14.el8_4.4 | < 2:2.2.0-7.el8_6.13 | < 2:2.2.0-12.el8_8.12 | < 2:2.4.1-6.el9_2.13 | < 2:2.11.7-7.el9_8.7 | < 2:3.10.3-12.el10_2.11 | < 2:2.11.7-13.el8_10
  • freerdp-devel< 2:2.11.7-1.el9_6.14 | < 0:2.1.1-5.el7_9.13 | < 2:2.11.7-7.el9_8.7 | < 2:3.10.3-12.el10_2.11 | < 2:2.11.7-13.el8_10
  • freerdp-libs< 2:2.11.7-1.el9_6.14 | < 2:2.11.2-1.el9_4.12 | < 2:2.2.0-14.el8_4.4 | < 2:2.2.0-7.el8_6.13 | < 2:2.2.0-12.el8_8.12 | < 2:2.4.1-6.el9_2.13 | < 0:2.1.1-5.el7_9.13 | < 2:2.11.7-7.el9_8.7 | < 2:3.10.3-12.el10_2.11 | < 2:2.11.7-13.el8_10
Ubuntu3 products
  • freerdpAll versions (No fix recorded)
  • freerdp2All versions (No fix recorded)
  • freerdp3< 3.30.0+dfsg-0ubuntu0.24.04.1 | All versions (No fix recorded) | < 3.30.0+dfsg-0ubuntu0.26.04.1
Debian2 products
  • freerdp2All versions (No fix recorded)
  • freerdp3All versions (No fix recorded) | < 3.27.0+dfsg-1
Freerdp1 product

4 vendors · 17 products

References

32 links
Show all 32 references