Skip to content
OpenAdvisories
High · 8.7 CVE-2026-55194 EUVD-2026-62667

FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch

Published Aug 19, 2026 · Updated Aug 27, 2026 · Assigned by GitHub_M

Vendor: FreeRDP Product: FreeRDP Package: freerdp Package: freerdp Package: freerdp2 Package: freerdp2 Package: freerdp3 Package: freerdp3 Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the server-declared alloc_hint rather than the actual StubLength about to be written. A malicious TS Gateway can send a PTYPE_RESPONSE with a small alloc_hint and a much larger frag_length, causing Stream_Write to copy attacker-controlled stub data beyond the 4096-byte pdu->s buffer. This can crash the client and may permit code execution through heap corruption. This issue is fixed in version 3.27.0.

Affected products

VendorProductAffectedFixed
FreeRDP FreeRDP < 3.27.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 freerdp3 3.27.0+dfsg-1 —
Debian 13 freerdp3 No fix yet —
Debian 12 freerdp2 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS freerdp3 3.30.0+dfsg-0ubuntu0.26.04.1 USN-8561-1
Ubuntu 25.10 freerdp3 No fix yet —
Ubuntu 24.04 LTS freerdp3 3.30.0+dfsg-0ubuntu0.24.04.1 USN-8561-1
Ubuntu 22.04 LTS freerdp2 No fix yet —
Ubuntu 18.04 LTS freerdp No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS freerdp No fix yet —
Ubuntu Pro 24.04 LTS freerdp2 No fix yet —
Ubuntu Pro 20.04 LTS freerdp2 No fix yet —
Ubuntu Pro 18.04 LTS freerdp2 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 freerdp +5 2:3.10.3-12.el10_2.10 RHSA-2026:61378
RHEL 9 freerdp +4 2:2.11.7-7.el9_8.6 RHSA-2026:61379
RHEL 8 freerdp +4 2:2.11.7-12.el8_10 RHSA-2026:62571
Show 11 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS freerdp +5 2:3.10.3-3.el10_0.16 RHSA-2026:68706
RHEL 9.6 EUS freerdp +4 2:2.11.7-1.el9_6.13 RHSA-2026:71387
RHEL 9.4 E4S freerdp +2 2:2.11.2-1.el9_4.11 RHSA-2026:71390
RHEL 9.2 E4S freerdp +2 2:2.4.1-6.el9_2.12 RHSA-2026:71388
RHEL 8.8 TUS freerdp +3 2:2.2.0-12.el8_8.11 RHSA-2026:66282
RHEL 8.8 E4S freerdp +3 2:2.2.0-12.el8_8.11 RHSA-2026:66282
RHEL 8.6 EUS Long Life freerdp +3 2:2.2.0-7.el8_6.12 RHSA-2026:66281
RHEL 8.6 AUS freerdp +3 2:2.2.0-7.el8_6.12 RHSA-2026:66281
RHEL 8.4 EUS Long Life freerdp +3 2:2.2.0-14.el8_4.3 RHSA-2026:65855
RHEL 8.4 AUS freerdp +3 2:2.2.0-14.el8_4.3 RHSA-2026:65855
RHEL 7 ELS freerdp +4 2.1.1-5.el7_9.12 RHSA-2026:68707

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 freerdp +5 2:3.10.3-12.el10_2.10 ALSA-2026:61378
AlmaLinux 9 freerdp +4 2:2.11.7-7.el9_8.6 ALSA-2026:61379
AlmaLinux 8 freerdp +4 2:2.11.7-12.el8_10 ALSA-2026:62571

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 freerdp 2:3.10.3-12.el10_2.10 RLSA-2026:61378
Rocky Linux 9 freerdp 2:2.11.7-7.el9_8.6 RLSA-2026:61379
Rocky Linux 8 freerdp 2:2.11.7-12.el8_10 RLSA-2026:62571

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed freerdp 3.27.1-1.1 openSUSE-SU-2026:11065-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 freerdp 3.27.1-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 freerdp +5 2:3.6.3-1.amzn2023.0.13 ALAS2023-2026-2012
Amazon Linux 2 freerdp +4 2:2.11.7-1.amzn2.0.13 ALAS2-2026-3840

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 7 freerdp +4 2.1.1-5.0.13.el7_9 ELSA-2026-68707

Advisories 23

References