REDHAT-BUG-2519824: High severity FreeRDP vulnerability

Q: Who is exposed to this issue?

FreeRDP clients earlier than 3.27.0 are exposed when they communicate with a malicious TS Gateway. The gateway can send a crafted RPC PTYPE_RESPONSE to the client.

Q: What does an attacker need to exploit it?

An attacker needs to control, or be able to impersonate, the TS Gateway used by the vulnerable FreeRDP client. They must send a response with a small server-declared alloc_hint and a substantially larger fragment length.

Q: What is the impact of successful exploitation?

The crafted response can cause attacker-controlled stub data to be written beyond the 4096-byte pdu->s buffer, resulting in heap corruption. This can crash the client and may allow code execution.

Published Aug 19, 2026

Updated

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpcclientrecvfragment in libfreerdp/core/gateway/rpcclient.c ensures the response reassembly stream capacity using only the server-declared allochint rather than the actual StubLength about to be written. A malicious TS Gateway can send a PTYPERESPONSE with a small allochint and a much larger fraglength, causing StreamWrite to copy attacker-controlled stub data beyond the 4096-byte pdu->s buffer. This can crash the client and may permit code execution through heap corruption. This issue is fixed in version 3.27.0.

Affected Software

1 affected component

FreeRDP<3.27.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.27.0

Event History

Aug 19, 2026

Data Sourced

via Red Hat·06:08 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

FreeRDP clients earlier than 3.27.0 are exposed when they communicate with a malicious TS Gateway. The gateway can send a crafted RPC PTYPE_RESPONSE to the client.

What does an attacker need to exploit it?

An attacker needs to control, or be able to impersonate, the TS Gateway used by the vulnerable FreeRDP client. They must send a response with a small server-declared alloc_hint and a substantially larger fragment length.

What is the impact of successful exploitation?

The crafted response can cause attacker-controlled stub data to be written beyond the 4096-byte pdu->s buffer, resulting in heap corruption. This can crash the client and may allow code execution.

What should be done if systems cannot be updated immediately?

Avoid connecting vulnerable FreeRDP clients to untrusted or potentially malicious TS Gateways until FreeRDP can be updated. The issue is fixed in FreeRDP 3.27.0.