CVE-2026-55827: FreeRDP: Heap out-of-bounds write in RemoteFX (RFX) Cache Bitmap V3 decode
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched with the non-default /cache:codec:rfx option pass desktop stride and height to RemoteFX decoding for Cache Bitmap V3 data while allocating bitmap->data only for the smaller DstWidth and DstHeight in gdiBitmapDecompress, allowing a malicious RDP server to trigger a heap out-of-bounds write with attacker-controlled offset and content. This issue is fixed in version 3.27.1.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55827?
CVE-2026-55827 has a severity rating of high, with a score of 7.5.
How do I fix CVE-2026-55827?
To mitigate CVE-2026-55827, upgrade FreeRDP to version 3.27.1 or later.
What type of vulnerability is CVE-2026-55827?
CVE-2026-55827 is a heap out-of-bounds write vulnerability related to the RemoteFX Cache Bitmap V3 decode.
Who is affected by CVE-2026-55827?
CVE-2026-55827 affects FreeRDP clients that are launched with the /cache:codec:rfx option prior to version 3.27.1.
What are the potential impacts of CVE-2026-55827?
CVE-2026-55827 can lead to data corruption or arbitrary code execution due to memory corruption from out-of-bounds writes.