CVE-2026-55564Medium· 5.4▾ SunlitFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater than cache->number instead of greater than or equal to it. A malic…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.4%
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater than cache->number instead of greater than or equal to it. A malicious RDP server can use GLYPH_FRAGMENT_USE replay in update_process_glyph_fragments to make the default cache receive index 254 when cache->number is 254, reading one pointer beyond the entries array and dereferencing it as a glyph. This can crash the client and may disclose adjacent heap data. This issue is fixed in version 3.27.0.
freerdp < 3.27.0Upgrade past the affected range:
freerdp 3.27.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55192High· 8.2FreeRDP is a free implementation of the Remote Desktop Protocol
CVE-2026-55648High· 7.5FreeRDP is a free implementation of the Remote Desktop Protocol
CVE-2026-114041Medium· 6.5FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message
CVE-2026-114044Medium· 5.3FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline
CVE-2026-114043Medium· 6.5Vulnerability in FreeRDP
CVE-2026-111376Medium· 5.0FreeRDP 3.30.0 before 3.32.0 Heap Over-Read via Windows cliprdr FILECONTENTS_SIZE