CVE-2026-55564

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit an out-of-bounds read vulnerability in the glyph_cache_get function. By sending crafted glyph fragments, the server can cause the client to read beyond the intended memory buffer. This can lead to a client crash, resulting in a Denial of Service (DoS), and potentially disclose sensitive adjacent heap data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict FreeRDP client connections to trusted Remote Desktop Protocol (RDP) servers only. Avoid connecting to untrusted or potentially malicious RDP servers to prevent exploitation of this client-side vulnerability. If FreeRDP client functionality is not essential, consider removing the freerdp package and its dependencies.