CVE-2026-55194Critical· 9.8▾ AbyssalPoC availableFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the server-declared alloc_hint …
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
— → 8.8
none → high
Last analysed / modified upstream
8.7 → 9.8
high → critical
0.5% → 0.6%
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the server-declared alloc_hint rather than the actual StubLength about to be written. A malicious TS Gateway can send a PTYPE_RESPONSE with a small alloc_hint and a much larger frag_length, causing Stream_Write to copy attacker-controlled stub data beyond the 4096-byte pdu->s buffer. This can crash the client and may permit code execution through heap corruption. This issue is fixed in version 3.27.0.
freerdp < 3.27.0Upgrade past the affected range:
freerdp 3.27.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55193High· 8.8FreeRDP is a free implementation of the Remote Desktop Protocol
CVE-2026-63633Critical· 9.8FreeRDP is a free implementation of the Remote Desktop Protocol
CVE-2026-55191Critical· 9.8FreeRDP is a free implementation of the Remote Desktop Protocol
CVE-2026-55192High· 8.2FreeRDP is a free implementation of the Remote Desktop Protocol
CVE-2026-73242Critical· 9.1FreeRDP is a free implementation of the Remote Desktop Protocol
CVE-2026-67301High· 7.5FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders