CVE-2026-55827

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.27.1

Description When clients are launched with the non-default /cache:codec:rfx option, the software passes the desktop stride and height to RemoteFX decoding for Cache Bitmap V3 data. However, in the gdi Bitmap Decompress() function, the bitmap->data is allocated only for the smaller DstWidth and DstHeight. This discrepancy allows a malicious RDP server to trigger a heap out-of-bounds write using an attacker-controlled offset and content. A heap out-of-bounds write occurs when a program writes data past the end of a memory buffer allocated on the heap, potentially leading to crashes or arbitrary code execution.

Recommendations Update to version 3.27.1. As a temporary mitigation, avoid using the /cache:codec:rfx option when launching clients.