CVE-2026-55648

The FreeRDP RDP client contains an integer overflow vulnerability in the freerdp_image_copy_from_icon_data function within libfreerdp/codec/color.c. The flaw occurs because the software performs 32-bit arithmetic when calculating the required size based on dimensions provided by a remote RDP serv...

CVE-2026-55648 FreeRDP: Integer Overflow in `freerdp_image_copy_from_icon_data` Bypasses Bounds Check

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, freerdpimagecopyfromicondata in libfreerdp/codec/color.c calculates nWidth multiplied by nHeight multiplied by FreeRDPGetBytesPerPixelformat in 32-bit arithmetic. A malicious RDP server can send a RAIL TSICONINFO...

EUVD-2026-62666

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, freerdpimagecopyfromicondata in libfreerdp/codec/color.c calculates nWidth multiplied by nHeight multiplied by FreeRDPGetBytesPerPixelformat in 32-bit arithmetic. A malicious RDP server can send a RAIL TSICONINFO...