Buffer Overflow Vulnerability in FreeRDP Remote Desktop Implementation

CVE-2026-55564

What is CVE-2026-55564?

The FreeRDP implementation of the Remote Desktop Protocol contains a vulnerability in the glyph_cache_get function within the libfreerdp/cache/glyph.c file. This issue arises when the index is improperly validated, leading a malicious RDP server to exploit the glyph processing mechanism. Specifically, if the cache's number of items is set to 254, an attacker can trigger a replay attack utilizing the GLYPH_FRAGMENT_USE to have the default cache index set to 254. This could result in accessing memory beyond the intended limit, potentially causing a crash of the client or revealing sensitive data stored in adjacent heap memory. The issue has been addressed in version 3.27.0.

References