CVE-2026-55827 Details

A remote code execution vulnerability has been identified in FreeRDP clients versions through 3.27.0. The issue arises when the client is launched with the non-default '/cache:codec:rfx' option. In this scenario, the client improperly handles Cache Bitmap V3 data by passing incorrect dimensions to the RemoteFX decoder. This flaw allows a malicious RDP server to exploit the client, leading to a heap out-of-bounds write with attacker-controlled content and offsets. The vulnerability is triggered during the decoding of Cache Bitmap V3 data, where the server can manipulate the tile positions to write beyond the allocated buffer, potentially overwriting critical data such as function pointers.

Users can update to FreeRDP version 3.27.1 or later, where this vulnerability has been fixed.