CVE-2026-55194: FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpcclientrecvfragment in libfreerdp/core/gateway/rpcclient.c ensures the response reassembly stream capacity using only the server-declared allochint rather than the actual StubLength about to be written. A malicious TS Gateway can send a PTYPERESPONSE with a small allochint and a much larger fraglength, causing StreamWrite to copy attacker-controlled stub data beyond the 4096-byte pdu->s buffer. This can crash the client and may permit code execution through heap corruption. This issue is fixed in version 3.27.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDP TS Gatewayto a version that resolves this vulnerability.Fixed in 3.27.0
Event History
Frequently Asked Questions
Which deployments are exposed?
FreeRDP clients running versions before 3.27.0 are exposed when they connect through a malicious TS Gateway.
What does an attacker need to control to exploit this issue?
The attacker needs to operate or control a TS Gateway that can send a crafted RPC PTYPE_RESPONSE with a small alloc_hint and a larger fragment length.
Which version contains the fix?
The issue is fixed in FreeRDP version 3.27.0. Versions prior to 3.27.0 are affected.