CVE-2026-55648

highpriority · track · 30EPSS 0.004 · 37 %ileDERUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.43% (37th) EPSS

CVSS 7.5 · high

Is it mine?

18 products

Check your exposure

Who says so?

3 sources

fstec_bdu · cert_bund · nvd

EPSS · scored 2026-10-28

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, freerdp_image_copy_from_icon_data in libfreerdp/codec/color.c calculates nWidth multiplied by nHeight multiplied by FreeRDPGetBytesPerPixel(format) in 32-bit arithmetic. A malicious RDP server can send a RAIL TS_ICON_INFO update with dimensions such as 32768 by 32768 and 32 bits per pixel so the required-size calculation wraps, bypassing the cbBitsColor source bounds check before freerdp_image_copy_no_overlap reads attacker-controlled icon data. This affects RemoteApp clients using the vulnerable library path, while xfreerdp has a caller-side mitigation. This issue is fixed in version 3.27.0.

cvss

Technical severity, 0–10. One row per scoring source.

8.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 2.4–8.1

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.18.1highAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:Hsecondary · FSTEC (BDU) RU

v4.06.1mediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · security-advisories@github.com

v4.02.4lowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-190USCWE-190US

affected products (18)

Products and version ranges known to be affected.

Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
RESF Rocky Linuxall versionscert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Open Source FreeRDP< 3.27.0cert_bundDE
Canonical Ltd. Ubuntu≤ 24.04 LTSfstec_bduRU
Canonical Ltd. Ubuntu≤ 26.04 LTSfstec_bduRU
Free Software Foundation, Inc. FreeRDP≤ 3.27.0fstec_bduRU
Red Hat, Inc. Red Hat Enterprise Linux≤ 9fstec_bduRU
Red Hat, Inc. Red Hat Enterprise Linux≤ 7fstec_bduRU
Red Hat, Inc. Red Hat Enterprise Linux≤ 8fstec_bduRU
Red Hat, Inc. Red Hat Enterprise Linux≤ 10fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 8.0fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 13fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 11fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 10fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 12fstec_bduRU
freerdp freerdp< 3.27.0nvdUScpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-1933FreeRDP: Mehrere SchwachstellenDeutsch2026-06-15csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in FreeRDP ausnutzen,um nicht näher spezifizierte Auswirkungen zu verursachen, potenziell beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

also known as (2)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

fstec_bdu cert_bund nvd NVD CVE.org MITRE

published 2026-08-19modified 2026-10-26

references (4) nvd

External citations — patches, advisories, analysis.

https://github.com/FreeRDP/FreeRDP/commit/e4ae473da2926724d9b6329778797a3bdea79eb3Patch
https://github.com/FreeRDP/FreeRDP/pull/12877Issue TrackingPatch
https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0Release Notes
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5c5v-f78v-h2f6MitigationVendor Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan