CVE-2026-55648
MediumCVSS 6.1Summary
FreeRDP prior to 3.27.0 has a vulnerability in freerdp_image_copy_from_icon_data in libfreerdp/codec/color.c where nWidth multiplied by nHeight multiplied by FreeRDPGetBytesPerPixel(format) is calculated in 32-bit arithmetic. A malicious RDP server can send a RAIL TS_ICON_INFO update with dimensions such as 32768 by 32768 and 32 bits per pixel so the required-size calculation wraps, bypassing the cbBitsColor source bounds check before freerdp_image_copy_no_overlap reads attacker-controlled icon data. This affects RemoteApp clients using the vulnerable library path, while xfreerdp has a caller-side mitigation. This issue is fixed in version 3.27.0.
Risk Assessment
The risk includes potential out-of-bounds read, leading to client crashes or memory disclosure, and potentially arbitrary code execution in the client context.
Recommendation
It is recommended to upgrade FreeRDP to version 3.27.0 or later, which includes the fix. Also, monitor RAIL updates from RDP servers for suspicious dimensions.
Original NVD description (English source)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, freerdp_image_copy_from_icon_data in libfreerdp/codec/color.c calculates nWidth multiplied by nHeight multiplied by FreeRDPGetBytesPerPixel(format) in 32-bit arithmetic. A malicious RDP server can send a RAIL TS_ICON_INFO update with dimensions such as 32768 by 32768 and 32 bits per pixel so the required-size calculation wraps, bypassing the cbBitsColor source bounds check before freerdp_image_copy_no_overlap reads attacker-controlled icon data. This affects RemoteApp clients using the vulnerable library path, while xfreerdp has a caller-side mitigation. This issue is fixed in version 3.27.0.