CVE-2026-55191: Critical heap overflow in FreeRDP

CVE-2026-55191 describes an integer overflow in FreeRDP, an open-source Remote Desktop Protocol client. The bug resides in the H.264 codec for RDPGFX AVC444: during negotiation with an RDP server, the calculation of intermediate YUV444 size in libfreerdp/codec/h264.c uses 32-bit multiplication that can wrap to undersized values. A malicious RDP server exploits this by supplying crafted surface dimensions to cause undersized buffer allocation before data write. Impact: client crash (DoS) and potential code execution through attacker-controlled heap corruption.

The assigned CVSS score is 9.8, maximum severity (critical). The risk is especially high because FreeRDP is widely deployed in enterprise environments, Linux servers with remote RDP access, and thin-client implementations. A signal detected on 2026-11-08 in technical channels confirms security community attention on this flaw. The patch has been available since 2026-08-19 in version 3.27.0.

Defenders must: 1) map all FreeRDP clients in use (version and RDPGFX configuration); 2) prioritize deployment of version 3.27.0 to staging and then production; 3) if FreeRDP is distributed to external clients, establish communication and compliance verification; 4) verify that RDP servers are exposed only to restricted networks and require strong authentication to limit the attack vector (malicious RDP server). No confirmed public exploits are known at the time of assessment.