CVE-2026-55193

A flaw was found in FreeRDP. FreeRDP clients using TS Gateway are vulnerable to a heap-buffer-overflow. A malicious gateway can send a specially crafted response fragment, causing the client to write beyond its allocated buffer. This can lead to a client crash, resulting in a Denial of Service (DoS), and may also allow an attacker to execute arbitrary code on the client system.

This vulnerability is rated as having Important impact because a compromised Remote Desktop Gateway can achieve arbitrary code execution or crash the connecting client process via heap corruption. In Red Hat Enterprise Linux, FreeRDP is deployed as an outbound client utility rather than a persistent listening network service, meaning exploitation requires a user or automated workflow to initiate a connection to a rogue gateway host. Furthermore, the vulnerable code path is confined strictly to sessions utilizing the Terminal Services Gateway transport over RPC, leaving direct RDP connections and server implementations unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.