CVE-2026-55191: FreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocation
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in libfreerdp/codec/h264.c with 32-bit multiplication in avc444ensurebuffer. A malicious RDP server can supply surface dimensions for which piDstStride multiplied by padDstHeight wraps to a small nonzero value, causing winpralignedrecalloc to allocate an undersized buffer before YUV420CombineToYUV444 writes using the actual stride and rectangle dimensions. This can cause a client crash and may permit code execution through attacker-influenced heap corruption. This issue is fixed in version 3.27.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.27.0
Event History
Frequently Asked Questions
Which deployments are exposed to a malicious server?
FreeRDP clients prior to 3.27.0 are exposed when they negotiate RDPGFX AVC444 and use an H.264 decoder backend. The vulnerable endpoint is the client connecting to a malicious RDP server.
What does an attacker need to do to exploit this issue?
An attacker needs to operate or control an RDP server that a vulnerable FreeRDP client connects to, then provide crafted surface dimensions that cause the intermediate YUV444 allocation calculation to wrap. Exploitation can crash the client and may allow code execution through heap corruption.
How can I determine whether a client is affected?
Check whether the FreeRDP version is earlier than 3.27.0 and whether the client can negotiate RDPGFX AVC444 with an H.264 decoder backend. Clients not meeting those conditions are not described as affected by the available information.
What is the remediation?
Upgrade FreeRDP to version 3.27.0 or later, which fixes the vulnerable allocation calculation.