FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response

A flaw was found in FreeRDP. A remote attacker, specifically a malicious TS Gateway, can exploit a heap-buffer-overflow vulnerability by sending a specially crafted Remote Desktop Protocol RDP response. This occurs because the client incorrectly uses a smaller allochint value instead of the actua...

FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response

A flaw was found in FreeRDP. A remote attacker, specifically a malicious TS Gateway, can exploit a heap-buffer-overflow vulnerability by sending a specially crafted Remote Desktop Protocol RDP response. This occurs because the client incorrectly uses a smaller allochint value instead of the actua...

FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response

A flaw was found in FreeRDP. A remote attacker, specifically a malicious TS Gateway, can exploit a heap-buffer-overflow vulnerability by sending a specially crafted Remote Desktop Protocol RDP response. This occurs because the client incorrectly uses a smaller allochint value instead of the actua...

FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response

A flaw was found in FreeRDP. A remote attacker, specifically a malicious TS Gateway, can exploit a heap-buffer-overflow vulnerability by sending a specially crafted Remote Desktop Protocol RDP response. This occurs because the client incorrectly uses a smaller allochint value instead of the actua...

CVE-2026-55193

A flaw was found in FreeRDP. FreeRDP clients using TS Gateway are vulnerable to a heap-buffer-overflow. A malicious gateway can send a specially crafted response fragment, causing the client to write beyond its allocated buffer. This can lead to a client crash, resulting in a Denial of Service Do...

CVE-2026-55194

A flaw was found in FreeRDP. A remote attacker, specifically a malicious TS Gateway, can exploit a heap-buffer-overflow vulnerability by sending a specially crafted Remote Desktop Protocol RDP response. This occurs because the client incorrectly uses a smaller allochint value instead of the actua...

CVE-2026-55194

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpcclientrecvfragment in libfreerdp/core/gateway/rpcclient.c ensures the response reassembly stream capacity using only the server-declared allochint rather than the actual StubLength about to be written. A maliciou...

CVE-2026-55193

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled maxxmitfrag value in libfreerdp/core/gateway/rpcbind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise...

CVE-2026-55194 FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpcclientrecvfragment in libfreerdp/core/gateway/rpcclient.c ensures the response reassembly stream capacity using only the server-declared allochint rather than the actual StubLength about to be written. A maliciou...

CVE-2026-55194

In FreeRDP before 3.27.0, the function rpc_client_recv_fragment() in libfreerdp/core/gateway/rpc_client.c grows the reassembly buffer based solely on the server-declared alloc_hint rather than the actual StubLength, so a malicious TS Gateway can trigger a heap-buffer overflow write past the 4096-...

CVE-2026-55194 FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpcclientrecvfragment in libfreerdp/core/gateway/rpcclient.c ensures the response reassembly stream capacity using only the server-declared allochint rather than the actual StubLength about to be written. A maliciou...

CVE-2026-55194

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpcclientrecvfragment in libfreerdp/core/gateway/rpcclient.c ensures the response reassembly stream capacity using only the server-declared allochint rather than the actual StubLength about to be written. A maliciou...

EUVD-2026-62667

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpcclientrecvfragment in libfreerdp/core/gateway/rpcclient.c ensures the response reassembly stream capacity using only the server-declared allochint rather than the actual StubLength about to be written. A maliciou...

CVE-2026-55194 FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpcclientrecvfragment in libfreerdp/core/gateway/rpcclient.c ensures the response reassembly stream capacity using only the server-declared allochint rather than the actual StubLength about to be written. A maliciou...

CVE-2026-55193 FreeRDP: Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bind_ack max_xmit_frag

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled maxxmitfrag value in libfreerdp/core/gateway/rpcbind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise...

CVE-2026-55193 FreeRDP: Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bind_ack max_xmit_frag

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled maxxmitfrag value in libfreerdp/core/gateway/rpcbind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise...

CVE-2026-55193

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled maxxmitfrag value in libfreerdp/core/gateway/rpcbind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise...

CVE-2026-55193

FreeRDP clients using TS Gateway assign a server-controlled max_xmit_frag value (up to 65535) to rpc->max_recv_frag in rpc_bind.c without capping it to the 4088-byte ReceiveFragment buffer, so rpc_channel_read in rpc.c writes up to 65535 bytes, overflowing by up to 61447 attacker-controlled by...

EUVD-2026-62664

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled maxxmitfrag value in libfreerdp/core/gateway/rpcbind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise...

Important: freerdp

Issue Overview: Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bindack maxxmitfrag On TS Gateway connections, rpc-maxrecvfrag is initialized to 0x0FF8 4088 and ReceiveFragment is allocated to that size. In rpcbind.c, the client assigns rpc-maxrecvfrag =...