CVE-2026-55648: FreeRDP: Integer Overflow in `freerdp_image_copy_from_icon_data` Bypasses Bounds Check
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, freerdpimagecopyfromicondata in libfreerdp/codec/color.c calculates nWidth multiplied by nHeight multiplied by FreeRDPGetBytesPerPixel(format) in 32-bit arithmetic. A malicious RDP server can send a RAIL TSICONINFO update with dimensions such as 32768 by 32768 and 32 bits per pixel so the required-size calculation wraps, bypassing the cbBitsColor source bounds check before freerdpimagecopynooverlap reads attacker-controlled icon data. This affects RemoteApp clients using the vulnerable library path, while xfreerdp has a caller-side mitigation. This issue is fixed in version 3.27.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.27.0
Event History
Frequently Asked Questions
Which deployments are exposed?
The affected path is used by RemoteApp clients using vulnerable libfreerdp versions prior to 3.27.0. The xfreerdp client has a caller-side mitigation.
What must an attacker control to trigger the issue?
An attacker needs to operate or control a malicious RDP server that can send a RAIL TS_ICON_INFO update with crafted icon dimensions and attacker-controlled icon data. Dimensions such as 32768 by 32768 at 32 bits per pixel can cause the required-size calculation to wrap.
What should be done if the library cannot be updated immediately?
Avoid connecting affected RemoteApp clients to untrusted RDP servers until libfreerdp can be updated to 3.27.0. xfreerdp has a caller-side mitigation, but the issue affects other RemoteApp clients using the vulnerable library path.