Medium [CVE-2026-55564] Out-of-bounds read in glyph cache leads to denial of service and information disclosure
This medium-severity Red Hat Linux advisory covers CVE-2026-55564 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater than cache->number instead of greater than or equal to it.
A malicious RDP server can use GLYPH_FRAGMENT_USE replay in update_process_glyph_fragments to make the default cache receive index 254 when cache->number is 254, reading one pointer beyond the entries array and dereferencing it as a glyph. This can crash the client and may disclose adjacent heap data.
This issue is fixed in version 3.27.0. A flaw was found in FreeRDP.
A malicious Remote Desktop Protocol (RDP) server can exploit an out-of-bounds read vulnerability in the glyph_cache_get function. By sending crafted glyph fragments, the server can cause the client to read beyond the intended memory buffer.
Red Hat severity: Moderate — CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L). Weakness: CWE-125.
Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6.
Red Hat does not currently list a fixing RHSA for this CVE.
Affected products named by the advisory: Red Hat package: freerdp.
- < 3.27.0
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- Restrict FreeRDP client connections to trusted Remote Desktop Protocol (RDP) servers only. Avoid connecting to untrusted or potentially malicious RDP servers to prevent exploitation of this client-side vulnerability. If FreeRDP client functionality is not essential, consider removing the `freerdp` package and its dependencies.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.