Medium [CVE-2026-55648] Integer overflow allows out-of-bounds read via malicious RDP server
This medium-severity Red Hat Linux advisory covers CVE-2026-55648 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, freerdp_image_copy_from_icon_data in libfreerdp/codec/color.c calculates nWidth multiplied by nHeight multiplied by FreeRDPGetBytesPerPixel(format) in 32-bit arithmetic.
A malicious RDP server can send a RAIL TS_ICON_INFO update with dimensions such as 32768 by 32768 and 32 bits per pixel so the required-size calculation wraps, bypassing the cbBitsColor source bounds check before freerdp_image_copy_no_overlap reads attacker-controlled icon data.
This affects RemoteApp clients using the vulnerable library path, while xfreerdp has a caller-side mitigation. This issue is fixed in version 3.27.0.
An integer overflow vulnerability in the `freerdp_image_copy_from_icon_data` function allows a malicious Remote Desktop Protocol (RDP) server to bypass a bounds check. By sending a specially crafted icon update with large dimensions, the server can cause the client to read attacker-controlled data beyond the intended memory buffer.
This out-of-bounds read can lead to information disclosure or potentially arbitrary code execution on affected RemoteApp clients. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L).
Weakness: CWE-125.
- < 3.27.0
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- The vulnerability requires a client to connect to a malicious RDP server. To mitigate this risk, users should avoid connecting to untrusted or unknown RDP servers. Restricting network access to only known and trusted RDP servers can also reduce the attack surface.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.