CVE-2026-55191

A flaw was found in FreeRDP. FreeRDP clients that negotiate RDPGFX AVC444 with an H.264 decoder backend are vulnerable to a heap-buffer-overflow. A malicious Remote Desktop Protocol (RDP) server can supply crafted surface dimensions, causing an undersized buffer to be allocated. This can lead to a client crash and potentially allow for arbitrary code execution through attacker-influenced heap corruption.

This vulnerability is rated as Important severity because an attacker controlling a remote server can cause heap corruption on the connecting client, potentially allowing remote code execution with the privileges of the local user. To exploit this flaw, a user must actively connect to a malicious or compromised endpoint that negotiates the AVC444 graphics pipeline using the H.264 video codec. Server-only deployments and client sessions that do not negotiate this specific display pipeline are not impacted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.