CVE-2026-55648

UNKNOWN 0.0

FreeRDP: Integer Overflow in `freerdp_image_copy_from_icon_data` Bypasses Bounds Check

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, freerdp_image_copy_from_icon_data in libfreerdp/codec/color.c calculates nWidth multiplied by nHeight multiplied by FreeRDPGetBytesPerPixel(format) in 32-bit arithmetic. A malicious RDP server can send a RAIL TS_ICON_INFO update with dimensions such as 32768 by 32768 and 32 bits per pixel so the required-size calculation wraps, bypassing the cbBitsColor source bounds check before freerdp_image_copy_no_overlap reads attacker-controlled icon data. This affects RemoteApp clients using the vulnerable library path, while xfreerdp has a caller-side mitigation. This issue is fixed in version 3.27.0.

CWE	CWE-190
Vendor	freerdp
Product	freerdp
Published	Aug 19, 2026

Stay Ahead of the Next One

Get instant alerts for freerdp freerdp

Be the first to know when new unknown vulnerabilities affecting freerdp freerdp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

FreeRDP / FreeRDP

< 3.27.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5c5v-f78v-h2f6 github.com: https://github.com/FreeRDP/FreeRDP/pull/12877 github.com: https://github.com/FreeRDP/FreeRDP/commit/e4ae473da2926724d9b6329778797a3bdea79eb3 github.com: https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0