CVE-2026-55564

MEDIUM 5.4

FreeRDP: Out-of-bounds read in glyph_cache_get via crafted glyph fragments

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater than cache->number instead of greater than or equal to it. A malicious RDP server can use GLYPH_FRAGMENT_USE replay in update_process_glyph_fragments to make the default cache receive index 254 when cache->number is 254, reading one pointer beyond the entries array and dereferencing it as a glyph. This can crash the client and may disclose adjacent heap data. This issue is fixed in version 3.27.0.

CWE	CWE-125 CWE-193
Vendor	freerdp
Product	freerdp
Published	Aug 19, 2026

Stay Ahead of the Next One

Get instant alerts for freerdp freerdp

Be the first to know when new medium vulnerabilities affecting freerdp freerdp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Affected Versions

FreeRDP / FreeRDP

< 3.27.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6xmj-pr98-cx4c github.com: https://github.com/FreeRDP/FreeRDP/pull/12885 github.com: https://github.com/FreeRDP/FreeRDP/commit/c29324750e3cbcba8761f147b7a5235cc686930f github.com: https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0