CVE-2026-55827: freerdp Incorrect Calculation of Buffer Size
Vulnerability summary
CVE-2026-55827 is a high (CVSS 8.8) Incorrect Calculation of Buffer Size vulnerability in freerdp. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 43.9% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 10-07-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched with the non-default /cache:codec:rfx option pass desktop stride and height to RemoteFX decoding for Cache Bitmap V3 data while allocating bitmap->data only for the smaller DstWidth and DstHeight in gdi_Bitmap_Decompress, allowing a malicious RDP server to trigger a heap out-of-bounds write with attacker-controlled offset and content. This issue is fixed in version 3.27.1.
CVSS metrics
5 scores · 5 sources · 1 version- CVE.orgCNA7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.53%
Chance of exploitation in the next 30 days
Percentile
44%
Versus all other CVEs
30-day change
+0.19 pp
From 0.34% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundFreerdp
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Redhat11 products
- freerdp< 2:3.10.3-12.el10_2.7 | < 2:3.10.3-3.el10_0.10
- freerdp-debuginfo< 2:3.10.3-12.el10_2.7 | < 2:3.10.3-3.el10_0.10
- freerdp-debugsource< 2:3.10.3-12.el10_2.7 | < 2:3.10.3-3.el10_0.10
- freerdp-devel< 2:3.10.3-12.el10_2.7 | < 2:3.10.3-3.el10_0.10
- freerdp-libs< 2:3.10.3-12.el10_2.7 | < 2:3.10.3-3.el10_0.10
Ubuntu3 products
- freerdpAll versions (No fix recorded)
- freerdp2All versions (No fix recorded)
- freerdp3< 3.30.0+dfsg-0ubuntu0.24.04.1 | All versions (No fix recorded) | < 3.30.0+dfsg-0ubuntu0.26.04.1
Debian2 products
- freerdp2All versions (No fix recorded)
- freerdp3All versions (No fix recorded) | < 3.27.1+dfsg-1
Freerdp1 product
- freerdp< 3.27.1
4 vendors · 17 products
References
16 links- github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c495-h83v-3prpX Refsource CONFIRMARTICLEREPORTExploitMitigationVendor Advisory
- github.com/FreeRDP/FreeRDP/commit/e58adf922ea4c0d5495e59a1fe488d70092e0e3eX Refsource MISCARTICLEPatch
