{"id":"CVE-2026-55827","title":"FreeRDP is a free implementation of the Remote Desktop Protocol","summary":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched with the non-default /cache:codec:rfx option pass desktop stride and height to RemoteFX decoding for Cache Bitmap V3 data while al…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-131","CWE-787"],"published":"2026-07-10","updated":"2026-07-10","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55827","references":[{"url":"https://github.com/FreeRDP/FreeRDP/commit/e58adf922ea4c0d5495e59a1fe488d70092e0e3e","label":"security-advisories@github.com"},{"url":"https://github.com/FreeRDP/FreeRDP/pull/12899","label":"security-advisories@github.com"},{"url":"https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.1","label":"security-advisories@github.com"},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c495-h83v-3prp","label":"security-advisories@github.com"},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c495-h83v-3prp","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00339,"epssPercentile":0.27475,"ingestedAt":"2026-07-11T20:15:26.715Z","slug":"CVE-2026-55827","body":"## Overview\n\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched with the non-default /cache:codec:rfx option pass desktop stride and height to RemoteFX decoding for Cache Bitmap V3 data while allocating bitmap->data only for the smaller DstWidth and DstHeight in gdi_Bitmap_Decompress, allowing a malicious RDP server to trigger a heap out-of-bounds write with attacker-controlled offset and content. This issue is fixed in version 3.27.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}