CVE-2026-55194

In FreeRDP before 3.27.0, the function rpc_client_recv_fragment() in libfreerdp/core/gateway/rpc_client.c grows the reassembly buffer based solely on the server-declared alloc_hint rather than the actual StubLength, so a malicious TS Gateway can trigger a heap-buffer overflow write past the 4096-...

CVE-2026-55193

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS Gateway accept a server-controlled maxxmitfrag value in libfreerdp/core/gateway/rpcbind.c without bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise...

CVE-2026-55193

FreeRDP clients using TS Gateway assign a server-controlled max_xmit_frag value (up to 65535) to rpc->max_recv_frag in rpc_bind.c without capping it to the 4088-byte ReceiveFragment buffer, so rpc_channel_read in rpc.c writes up to 65535 bytes, overflowing by up to 61447 attacker-controlled by...

CVE-2026-55194

Heap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to allochint capacity mismatch...

CVE-2026-55193

Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bindack maxxmitfrag...