Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-19T17:44:52 FreeRDP: FreeRDP: Arbitrary code execution via heap-buffer-overflow in AVC444 YUV buffer allocation 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CWE-787

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444_ensure_buffer. A malicious RDP server can supply surface dimensions for which piDstStride multiplied by padDstHeight wraps to a small nonzero value, causing winpr_aligned_recalloc to allocate an undersized buffer before YUV420CombineToYUV444 writes using the actual stride and rectangle dimensions. This can cause a client crash and may permit code execution through attacker-influenced heap corruption. This issue is fixed in version 3.27.0.

A flaw was found in FreeRDP. FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend are vulnerable to a heap-buffer-overflow. A malicious Remote Desktop Protocol (RDP) server can supply crafted surface dimensions, causing an undersized buffer to be allocated. This can lead to a client crash and potentially allow for arbitrary code execution through attacker-influenced heap corruption.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Enterprise Linux 10 Affected freerdp Red Hat Enterprise Linux 6 Out of support scope freerdp Red Hat Enterprise Linux 7 Affected freerdp Red Hat Enterprise Linux 8 Affected freerdp Red Hat Enterprise Linux 9 Affected freerdp https://www.cve.org/CVERecord?id=CVE-2026-55191 https://nvd.nist.gov/vuln/detail/CVE-2026-55191 https://github.com/FreeRDP/FreeRDP/commit/97f40b9e766af375f4e41ac6a3f4397d708d249c https://github.com/FreeRDP/FreeRDP/pull/12873 https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vx73-w5q6-7jqr