CVE-2026-55193: FreeRDP: Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bind_ack max_xmit_frag
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled maxxmitfrag value in libfreerdp/core/gateway/rpcbind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise 65535 and then send a response fragment of the same length, causing rpcchannelread in libfreerdp/core/gateway/rpc.c to write up to 65535 bytes into the smaller ReceiveFragment buffer. This can crash the client and may permit code execution through attacker-controlled heap corruption. This issue is fixed in version 3.27.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.27.0
Event History
Frequently Asked Questions
Which deployments are exposed?
FreeRDP clients prior to version 3.27.0 are exposed when they use a TS Gateway. The malicious endpoint is the TS Gateway, rather than the RDP server described by the connection target.
What does an attacker need to exploit this issue?
An attacker needs to operate or control a TS Gateway that the vulnerable FreeRDP client connects to. The gateway can advertise an oversized RPC bind acknowledgement fragment size and send a response fragment matching that size.
Are clients affected in their default configuration?
The issue affects clients using TS Gateway; the provided information does not establish whether TS Gateway use is enabled or configured by default. Clients not using a TS Gateway are not identified as affected by this flaw.
What can be done if upgrading is not immediately possible?
Avoid connecting vulnerable FreeRDP clients through untrusted or potentially malicious TS Gateways. Restrict TS Gateway use to trusted gateways until FreeRDP can be updated to 3.27.0.
How can I determine whether a client is vulnerable?
Check the installed FreeRDP version and whether the client uses a TS Gateway. Versions earlier than 3.27.0 that use TS Gateway are affected.