Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-55827

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched with the non-default /cache:codec:rfx option pass desktop stride and height to RemoteFX decoding for Cache Bitmap V3 data while allocating bitmap->data only for the smaller DstWidth and DstHeight in gdi_Bitmap_Decompress, allowing a malicious RDP server to trigger a heap out-of-bounds write with attacker-controlled offset and content. This issue is fixed in version 3.27.1.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:271fe0fc372f03687dad08979f60d92e47192652c98689e5b28c98ea4fca3bb2
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"cweId":"CWE-787","description":"CWE-787: Out-of-bounds Write","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:b81b69f7ed60de0082515712cca90627fac398be61a3743eb3bd83ddf895b2d1 · sha256:b8936523008a9beb… · /containers/cna/problemTypes/1/descriptions/0

{"cweId":"CWE-131","description":"CWE-131: Incorrect Calculation of Buffer Size","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:b81b69f7ed60de0082515712cca90627fac398be61a3743eb3bd83ddf895b2d1 · sha256:b8936523008a9beb… · /containers/cna/problemTypes/0/descriptions/0

Affected products and versions

1 source assertion
{"product":"FreeRDP","vendor":"FreeRDP","versions":[{"status":"affected","version":"< 3.27.1"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:b81b69f7ed60de0082515712cca90627fac398be61a3743eb3bd83ddf895b2d1 · sha256:b8936523008a9beb… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:b81b69f7ed60de0082515712cca90627fac398be61a3743eb3bd83ddf895b2d1 · sha256:b8936523008a9beb… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

2 source assertions
{"cweId":"CWE-787","description":"CWE-787: Out-of-bounds Write","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:b81b69f7ed60de0082515712cca90627fac398be61a3743eb3bd83ddf895b2d1 · sha256:b8936523008a9beb… · /containers/cna/problemTypes/1/descriptions/0
{"cweId":"CWE-131","description":"CWE-131: Incorrect Calculation of Buffer Size","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:b81b69f7ed60de0082515712cca90627fac398be61a3743eb3bd83ddf895b2d1 · sha256:b8936523008a9beb… · /containers/cna/problemTypes/0/descriptions/0

Source references

5 source assertions
{"name":"https://github.com/FreeRDP/FreeRDP/commit/e58adf922ea4c0d5495e59a1fe488d70092e0e3e","tags":["x_refsource_MISC"],"url":"https://github.com/FreeRDP/FreeRDP/commit/e58adf922ea4c0d5495e59a1fe488d70092e0e3e"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:b81b69f7ed60de0082515712cca90627fac398be61a3743eb3bd83ddf895b2d1 · sha256:b8936523008a9beb… · /containers/cna/references/2
{"name":"https://github.com/FreeRDP/FreeRDP/pull/12899","tags":["x_refsource_MISC"],"url":"https://github.com/FreeRDP/FreeRDP/pull/12899"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:b81b69f7ed60de0082515712cca90627fac398be61a3743eb3bd83ddf895b2d1 · sha256:b8936523008a9beb… · /containers/cna/references/1
{"name":"https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.1","tags":["x_refsource_MISC"],"url":"https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.1"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:b81b69f7ed60de0082515712cca90627fac398be61a3743eb3bd83ddf895b2d1 · sha256:b8936523008a9beb… · /containers/cna/references/3
{"name":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c495-h83v-3prp","tags":["x_refsource_CONFIRM"],"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c495-h83v-3prp"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:b81b69f7ed60de0082515712cca90627fac398be61a3743eb3bd83ddf895b2d1 · sha256:b8936523008a9beb… · /containers/cna/references/0
{"tags":["exploit"],"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c495-h83v-3prp"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:b81b69f7ed60de0082515712cca90627fac398be61a3743eb3bd83ddf895b2d1 · sha256:b8936523008a9beb… · /containers/adp/0/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer