CVE-2026-55564: FreeRDP: Out-of-bounds read in glyph_cache_get via crafted glyph fragments
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyphcacheget function in libfreerdp/cache/glyph.c checks whether index is greater than cache->number instead of greater than or equal to it. A malicious RDP server can use GLYPHFRAGMENTUSE replay in updateprocessglyphfragments to make the default cache receive index 254 when cache->number is 254, reading one pointer beyond the entries array and dereferencing it as a glyph. This can crash the client and may disclose adjacent heap data. This issue is fixed in version 3.27.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.27.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRDP clients prior to version 3.27.0 are exposed when they connect to a malicious RDP server. The affected path involves the default glyph cache.
What must an attacker do to trigger the flaw?
An attacker controlling an RDP server must send crafted glyph fragments that replay GLYPH_FRAGMENT_USE and cause index 254 to be used with a cache whose number is 254. Exploitation requires user interaction because a client must connect to the malicious server.
What is the impact and available fix?
The out-of-bounds pointer read can crash the FreeRDP client and may disclose adjacent heap data. The issue is fixed in FreeRDP version 3.27.0.