CVE-2026-55194

A flaw was found in FreeRDP. A remote attacker, specifically a malicious TS Gateway, can exploit a heap-buffer-overflow vulnerability by sending a specially crafted Remote Desktop Protocol (RDP) response. This occurs because the client incorrectly uses a smaller alloc_hint value instead of the actual StubLength for buffer capacity during response reassembly. This allows attacker-controlled data to be written beyond the intended buffer, leading to a client crash and potentially enabling arbitrary code execution.

A heap buffer overflow flaw was found in FreeRDP's TS Gateway RPC client (libfreerdp/core/gateway/rpc_client.c). During response fragment reassembly in rpc_client_recv_fragment, stream allocation relies on the server-provided alloc_hint rather than the actual StubLength. A malicious TS Gateway can send a PTYPE_RESPONSE packet with a small alloc_hint and a larger payload, causing Stream_Write to overwrite memory beyond the fixed 4096-byte buffer (pdu->s). This can result in client crashes or potential arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, avoid connecting through untrusted TS Gateways (RD Gateways) or disable gateway parameters (such as omitting /g: in xfreerdp) to force direct RDP connections and bypass RPC response parsing.