CVE-2026-55191
FreeRDP: FreeRDP: Arbitrary code execution via heap-buffer-overflow in AVC444 YUV buffer allocation
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (high), Amazon (high), Ubuntu (medium).
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444_ensure_buffer. A malicious RDP server can supply surface dimensions for which piDstStride multiplied by padDstHeight wraps to a small nonzero value, causing winpr_aligned_recalloc to allocate an undersized buffer before YUV420CombineToYUV444 writes using the actual stride and rectangle dimensions. This can cause a client crash and may permit code execution through attacker-influenced heap corruption. This issue is fixed in version 3.27.0.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.24 | freerdp | 3.27.1-r0 |
| alpine edge | freerdp | 3.27.1-r0 |
| amazon linux 2023 | freerdp, freerdp-debuginfo, freerdp-debugsource and 8 more | 2:3.6.3-1.amzn2023.0.13 |
| debian 11 | freerdp2 | no fix listed |
| debian 12 | freerdp2 | no fix listed |
| debian 13 | freerdp3 | no fix listed |
| debian 14 | freerdp3 | 3.27.0+dfsg-1 |
| echo | freerdp2, freerdp3 | no fix listed |
| rapidfort alpine 3.20 | freerdp | 3.27.1-r0 |
| rapidfort alpine 3.21 | freerdp | 3.27.1-r0 |
| rapidfort alpine 3.22 | freerdp | 3.27.1-r0 |
| rapidfort alpine 3.23 | freerdp | 3.27.1-r0 |
Show all 46 entries from 20 sources
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.24 | freerdp | 3.27.1-r0 |
| alpine edge | freerdp | 3.27.1-r0 |
| amazon linux 2023 | freerdp | 2:3.6.3-1.amzn2023.0.13 |
| amazon linux 2023 | freerdp-debuginfo | 2:3.6.3-1.amzn2023.0.13 |
| amazon linux 2023 | freerdp-debugsource | 2:3.6.3-1.amzn2023.0.13 |
| amazon linux 2023 | freerdp-devel | 2:3.6.3-1.amzn2023.0.13 |
| amazon linux 2023 | freerdp-libs | 2:3.6.3-1.amzn2023.0.13 |
| amazon linux 2023 | freerdp-libs-debuginfo | 2:3.6.3-1.amzn2023.0.13 |
| amazon linux 2023 | freerdp-server | 2:3.6.3-1.amzn2023.0.13 |
| amazon linux 2023 | freerdp-server-debuginfo | 2:3.6.3-1.amzn2023.0.13 |
| amazon linux 2023 | libwinpr | 2:3.6.3-1.amzn2023.0.13 |
| amazon linux 2023 | libwinpr-debuginfo | 2:3.6.3-1.amzn2023.0.13 |
| amazon linux 2023 | libwinpr-devel | 2:3.6.3-1.amzn2023.0.13 |
| debian 11 | freerdp2 | no fix listed |
| debian 12 | freerdp2 | no fix listed |
| debian 13 | freerdp3 | no fix listed |
| debian 14 | freerdp3 | 3.27.0+dfsg-1 |
| echo | freerdp2 | no fix listed |
| echo | freerdp3 | no fix listed |
| rapidfort alpine 3.20 | freerdp | 3.27.1-r0 |
| rapidfort alpine 3.21 | freerdp | 3.27.1-r0 |
| rapidfort alpine 3.22 | freerdp | 3.27.1-r0 |
| rapidfort alpine 3.23 | freerdp | 3.27.1-r0 |
| rapidfort alpine 3.24 | freerdp | 3.27.1-r0 |
| rapidfort amazon linux 2023 | freerdp | 2:3.6.3-1.amzn2023.0.13 |
| rapidfort amazon linux 2023 | freerdp-devel | 2:3.6.3-1.amzn2023.0.13 |
| rapidfort amazon linux 2023 | freerdp-libs | 2:3.6.3-1.amzn2023.0.13 |
| rapidfort amazon linux 2023 | freerdp-server | 2:3.6.3-1.amzn2023.0.13 |
| rapidfort amazon linux 2023 | libwinpr | 2:3.6.3-1.amzn2023.0.13 |
| rapidfort amazon linux 2023 | libwinpr-devel | 2:3.6.3-1.amzn2023.0.13 |
| rapidfort debian 12 | freerdp2 | no fix listed |
| rapidfort debian 12 | freerdp3 | 0:3.27.0+dfsg-1 |
| rapidfort debian 13 | freerdp2 | no fix listed |
| rapidfort debian 13 | freerdp3 | 0:3.27.0+dfsg-1 |
| rapidfort fedora 43 | freerdp | 2:3.27.1-1.fc43 |
| rapidfort fedora 43 | freerdp-devel | 2:3.27.1-1.fc43 |
| rapidfort fedora 43 | freerdp-libs | 2:3.27.1-1.fc43 |
| rapidfort fedora 43 | freerdp-server | 2:3.27.1-1.fc43 |
| rapidfort fedora 43 | libwinpr | 2:3.27.1-1.fc43 |
| rapidfort fedora 43 | libwinpr-devel | 2:3.27.1-1.fc43 |
| Red Hat | freerdp | no fix listed |
| Red Hat | freerdp-devel | no fix listed |
| Red Hat | freerdp-libs | no fix listed |
| Red Hat | freerdp-plugins | no fix listed |
| ubuntu 24.04 | freerdp3 | 3.30.0+dfsg-0ubuntu0.24.04.1 |
| ubuntu 26.04 | freerdp3 | 3.30.0+dfsg-0ubuntu0.26.04.1 |
References
- https://access.redhat.com/security/cve/CVE-2026-55191
- https://github.com/FreeRDP/FreeRDP/commit/97f40b9e766af375f4e41ac6a3f4397d708d249c
- https://github.com/FreeRDP/FreeRDP/pull/12873
- https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vx73-w5q6-7jqr
- https://nvd.nist.gov/vuln/detail/CVE-2026-55191
- https://ubuntu.com/security/notices/USN-8561-1
- https://www.cve.org/CVERecord?id=CVE-2026-55191