{"id":"CVE-2026-55564","aliases":["CLSA-2026-1791117866","CLSA-2026-1791184271","DEBIAN-CVE-2026-55564","EUVD-2026-62662","GHSA-6xmj-pr98-cx4c","UBUNTU-CVE-2026-55564","USN-8561-1"],"status":"published","title":"FreeRDP: Out-of-bounds read in glyph_cache_get via crafted glyph fragments","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater than cache-\u003enumber instead of greater than or equal to it. A malicious RDP server can use GLYPH_FRAGMENT_USE replay in update_process_glyph_fragments to make the default cache receive index 254 when cache-\u003enumber is 254, reading one pointer beyond the entries array and dereferencing it as a glyph. This can crash the client and may disclose adjacent heap data. This issue is fixed in version 3.27.0.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00328,"percentile":0.26099,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-193"],"published":"2026-07-09T00:00:00Z","modified":"2026-10-28T11:14:58Z","fixes":[{"ecosystem":"Debian:14","package":"freerdp3","fixed_in":["3.27.0+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"freerdp3","fixed_in":["3.30.0+dfsg-0ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"freerdp3","fixed_in":["3.30.0+dfsg-0ubuntu0.26.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"freerdp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"freerdp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libwinpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libwinpr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"freerdp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"freerdp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libwinpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libwinpr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.0+dfsg1-1","2.10.0+dfsg1-1.1","2.11.2+dfsg1-1","2.11.2+dfsg1-1.1~exp1","2.11.2+dfsg1-1.1~exp2","2.11.5+dfsg1-1","2.11.7+dfsg1-1","2.11.7+dfsg1-2","2.11.7+dfsg1-3","2.11.7+dfsg1-4","2.11.7+dfsg1-5","2.11.7+dfsg1-6","2.11.7+dfsg1-6~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.15.0+dfsg-2.1","3.15.0+dfsg-2.1+deb13u1","3.15.0+dfsg-2.1+deb13u2","3.15.0+dfsg-2.1+deb13u3","3.16.0+dfsg-1","3.16.0+dfsg-2","3.17.0+dfsg-1","3.17.1+dfsg-1","3.17.1+dfsg-2","3.17.2+dfsg-1","3.17.2+dfsg-2","3.17.2+dfsg-3","3.18.0+dfsg-1","3.19.0+dfsg-1","3.19.1+dfsg-1","3.20.0+dfsg-1","3.20.2+dfsg-1","3.21.0+dfsg-1","3.22.0+dfsg-1","3.22.0+dfsg-1~bpo13+0","3.22.0+dfsg-1~bpo13+1","3.22.0+dfsg-3","3.23.0+dfsg-1","3.23.0+dfsg-1~bpo13+1","3.24.0+dfsg-1","3.24.0+dfsg-2","3.24.1+dfsg-1","3.24.2+dfsg-1","3.24.2+dfsg-1~bpo13+1","3.25.0+dfsg-1","3.25.0+dfsg-2","3.25.0+dfsg-3","3.25.0+dfsg-4","3.25.0+dfsg-5","3.26.0+dfsg-1","3.26.0+dfsg-1~bpo13+1","3.27.0+dfsg-1","3.27.1+dfsg-1","3.28.0+dfsg-1","3.28.0+dfsg-2","3.29.0+dfsg-1","3.30.0+dfsg-1","3.30.0+dfsg-1~bpo13+1","3.31.0+dfsg-1","3.31.1+dfsg-1","3.31.1+dfsg-1~bpo13+1","3.32.0+dfsg-1","3.32.1+dfsg-1","3.32.1+dfsg-1~bpo13+1","3.32.2+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.27.0+dfsg-1"}]}],"versions":["3.15.0+dfsg-2.1","3.16.0+dfsg-1","3.16.0+dfsg-2","3.17.0+dfsg-1","3.17.1+dfsg-1","3.17.1+dfsg-2","3.17.2+dfsg-1","3.17.2+dfsg-2","3.17.2+dfsg-3","3.18.0+dfsg-1","3.19.0+dfsg-1","3.19.1+dfsg-1","3.20.0+dfsg-1","3.20.2+dfsg-1","3.21.0+dfsg-1","3.22.0+dfsg-1","3.22.0+dfsg-1~bpo13+0","3.22.0+dfsg-1~bpo13+1","3.22.0+dfsg-3","3.23.0+dfsg-1","3.23.0+dfsg-1~bpo13+1","3.24.0+dfsg-1","3.24.0+dfsg-2","3.24.1+dfsg-1","3.24.2+dfsg-1","3.24.2+dfsg-1~bpo13+1","3.25.0+dfsg-1","3.25.0+dfsg-2","3.25.0+dfsg-3","3.25.0+dfsg-4","3.25.0+dfsg-5","3.26.0+dfsg-1","3.26.0+dfsg-1~bpo13+1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.2","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0~git20170725.1.1648deb+dfsg1-1","2.0.0~git20170725.1.1648deb+dfsg1-5","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu1","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu2","2.0.0~git20170725.1.1648deb+dfsg1-6","2.0.0~git20170725.1.1648deb+dfsg1-6build1","2.0.0~git20170725.1.1648deb+dfsg1-7","2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1","2.1.1+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.2","2.2.0+dfsg1-0ubuntu0.18.04.3","2.2.0+dfsg1-0ubuntu0.18.04.4","2.2.0+dfsg1-0ubuntu0.18.04.4+esm1","2.2.0+dfsg1-0ubuntu0.18.04.4+esm2","2.2.0+dfsg1-0ubuntu0.18.04.4+esm3","2.2.0+dfsg1-0ubuntu0.18.04.4+esm4","2.2.0+dfsg1-0ubuntu0.18.04.4+esm5","2.2.0+dfsg1-0ubuntu0.18.04.4+esm6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1","1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1","1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0~git20190204.1.2693389a+dfsg1-1","2.0.0~git20190204.1.2693389a+dfsg1-2","2.0.0~git20190204.1.2693389a+dfsg1-2build1","2.0.0~git20190204.1.2693389a+dfsg1-2build2","2.1.1+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.2","2.2.0+dfsg1-0ubuntu0.20.04.3","2.2.0+dfsg1-0ubuntu0.20.04.4","2.2.0+dfsg1-0ubuntu0.20.04.5","2.2.0+dfsg1-0ubuntu0.20.04.6","2.6.1+dfsg1-0ubuntu0.20.04.1","2.6.1+dfsg1-0ubuntu0.20.04.2","2.6.1+dfsg1-0ubuntu0.20.04.2+esm1","2.6.1+dfsg1-0ubuntu0.20.04.2+esm2","2.6.1+dfsg1-0ubuntu0.20.04.2+esm3","2.6.1+dfsg1-0ubuntu0.20.04.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0+dfsg1-2build1","2.3.0+dfsg1-2ubuntu1","2.3.0+dfsg1-2ubuntu2","2.4.1+dfsg1-1","2.4.1+dfsg1-1ubuntu1","2.4.1+dfsg1-1ubuntu2","2.5.0+dfsg1-1","2.6.0+dfsg1-1","2.6.1+dfsg1-1","2.6.1+dfsg1-3","2.6.1+dfsg1-3ubuntu1","2.6.1+dfsg1-3ubuntu2","2.6.1+dfsg1-3ubuntu2.1","2.6.1+dfsg1-3ubuntu2.2","2.6.1+dfsg1-3ubuntu2.3","2.6.1+dfsg1-3ubuntu2.4","2.6.1+dfsg1-3ubuntu2.5","2.6.1+dfsg1-3ubuntu2.6","2.6.1+dfsg1-3ubuntu2.7","2.6.1+dfsg1-3ubuntu2.8","2.6.1+dfsg1-3ubuntu2.9","2.6.1+dfsg1-3ubuntu2.10","2.6.1+dfsg1-3ubuntu2.11"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.0+dfsg-0ubuntu0.24.04.1"}]}],"versions":["3.4.0+dfsg1-0ubuntu2","3.4.0+dfsg1-0ubuntu3","3.4.0+dfsg1-0ubuntu4","3.5.0+dfsg1-0ubuntu1","3.5.1+dfsg1-0ubuntu1","3.5.1+dfsg1-0ubuntu1.1","3.5.1+dfsg1-0ubuntu1.2","3.5.1+dfsg1-0ubuntu1.4","3.5.1+dfsg1-0ubuntu1.5","3.5.1+dfsg1-0ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.0+dfsg1-1.1ubuntu1","2.11.2+dfsg1-1","2.11.2+dfsg1-1build1","2.11.2+dfsg1-1build3","2.11.5+dfsg1-1build1","2.11.5+dfsg1-1build2","2.11.5+dfsg1-1ubuntu0.1~esm1","2.11.5+dfsg1-1ubuntu0.1~esm2","2.11.5+dfsg1-1ubuntu0.1~esm3","2.11.5+dfsg1-1ubuntu0.1~esm4","2.11.5+dfsg1-1ubuntu0.1~esm5","2.11.5+dfsg1-1ubuntu0.1~esm6"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.14.0+dfsg-1ubuntu1","3.15.0+dfsg-2.1","3.16.0+dfsg-1ubuntu1","3.16.0+dfsg-2","3.16.0+dfsg-2ubuntu0.1","3.16.0+dfsg-2ubuntu0.3","3.16.0+dfsg-2ubuntu0.4","3.16.0+dfsg-2ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.0+dfsg-0ubuntu0.26.04.1"}]}],"versions":["3.16.0+dfsg-2","3.18.0+dfsg-1ubuntu1","3.19.0+dfsg-1","3.19.1+dfsg-1","3.20.0+dfsg-1","3.20.2+dfsg-1","3.21.0+dfsg-1","3.22.0+dfsg-1","3.24.1+dfsg-1ubuntu1","3.24.2+dfsg-1ubuntu1","3.24.2+dfsg-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.0+dfsg-0ubuntu0.24.04.1"}]}],"versions":["3.4.0+dfsg1-0ubuntu2","3.4.0+dfsg1-0ubuntu3","3.4.0+dfsg1-0ubuntu4","3.5.0+dfsg1-0ubuntu1","3.5.1+dfsg1-0ubuntu1","3.5.1+dfsg1-0ubuntu1.1","3.5.1+dfsg1-0ubuntu1.2","3.5.1+dfsg1-0ubuntu1.4","3.5.1+dfsg1-0ubuntu1.5","3.5.1+dfsg1-0ubuntu1.6"],"bundled":34},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.0+dfsg-0ubuntu0.26.04.1"}]}],"versions":["3.16.0+dfsg-2","3.18.0+dfsg-1ubuntu1","3.19.0+dfsg-1","3.19.1+dfsg-1","3.20.0+dfsg-1","3.20.2+dfsg-1","3.21.0+dfsg-1","3.22.0+dfsg-1","3.24.1+dfsg-1ubuntu1","3.24.2+dfsg-1ubuntu1","3.24.2+dfsg-1ubuntu1.1"],"bundled":34}],"products":[{"vendor":"freerdp","product":"freerdp"}],"references":[{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6xmj-pr98-cx4c","tags":["x_refsource_CONFIRM","exploit","Exploit","Mitigation","Vendor Advisory","advisory","report"]},{"url":"https://github.com/FreeRDP/FreeRDP/pull/12885","tags":["x_refsource_MISC","Issue Tracking","Patch","fix"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/c29324750e3cbcba8761f147b7a5235cc686930f","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1791117866.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55191","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55192","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55564","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1791184271.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55564.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-55564","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-55564","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55564","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8561-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-27951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-29774","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-29775","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-29776","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31883","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31884","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31885","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-31897","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33952","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33977","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33982","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33983","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33984","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33985","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33986","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33987","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33995","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40033","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40254","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-44420","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-44421","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-44422","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55192","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55194","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55648","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-56297","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-57156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-57157","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-57158","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-55564","title":"FreeRDP: Out-of-bounds read in glyph_cache_get via crafted glyph fragments","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater than cache-\u003enumber instead of greater than or equal to it. A malicious RDP server can use GLYPH_FRAGMENT_USE replay in update_process_glyph_fragments to make the default cache receive index 254 when cache-\u003enumber is 254, reading one pointer beyond the entries array and dereferencing it as a glyph. This can crash the client and may disclose adjacent heap data. This issue is fixed in version 3.27.0.","status":"published","published":"2026-08-19T17:45:47.438Z","modified":"2026-08-25T03:33:53.901Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-125","CWE-193"],"updated_at":"2026-11-02T14:20:12.260247Z"}],"euvd":[{"id":"EUVD-2026-62662","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater than cache-\u003enumber instead of greater than or equal to it. A malicious RDP server can use GLYPH_FRAGMENT_USE replay in update_process_glyph_fragments to make the default cache receive index 254 when cache-\u003enumber is 254, reading one pointer beyond the entries array and dereferencing it as a glyph. This can crash the client and may disclose adjacent heap data. This issue is fixed in version 3.27.0.","status":"published","published":"2026-08-19T17:45:47Z","modified":"2026-08-25T03:33:53Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T18:01:33.760029Z"}],"nvd":[{"id":"CVE-2026-55564","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater than cache-\u003enumber instead of greater than or equal to it. A malicious RDP server can use GLYPH_FRAGMENT_USE replay in update_process_glyph_fragments to make the default cache receive index 254 when cache-\u003enumber is 254, reading one pointer beyond the entries array and dereferencing it as a glyph. This can crash the client and may disclose adjacent heap data. This issue is fixed in version 3.27.0.","status":"published","published":"2026-08-19T18:16:45.003Z","modified":"2026-10-26T11:10:00.157Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-125","CWE-193"],"updated_at":"2026-11-02T14:12:39.962615Z"}],"osv":[{"id":"CVE-2026-55564","title":"FreeRDP: Out-of-bounds read in glyph_cache_get via crafted glyph fragments","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater than cache-\u003enumber instead of greater than or equal to it. A malicious RDP server can use GLYPH_FRAGMENT_USE replay in update_process_glyph_fragments to make the default cache receive index 254 when cache-\u003enumber is 254, reading one pointer beyond the entries array and dereferencing it as a glyph. This can crash the client and may disclose adjacent heap data. This issue is fixed in version 3.27.0.","status":"published","published":"2026-08-19T17:45:47.438Z","modified":"2026-10-28T11:14:58.563549832Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-125","CWE-193"],"updated_at":"2026-11-02T15:45:11.22012Z"},{"id":"DEBIAN-CVE-2026-55564","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater than cache-\u003enumber instead of greater than or equal to it. A malicious RDP server can use GLYPH_FRAGMENT_USE replay in update_process_glyph_fragments to make the default cache receive index 254 when cache-\u003enumber is 254, reading one pointer beyond the entries array and dereferencing it as a glyph. This can crash the client and may disclose adjacent heap data. This issue is fixed in version 3.27.0.","status":"published","published":"2026-08-19T18:16:45.003Z","modified":"2026-10-27T10:02:09.684549399Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"UBUNTU-CVE-2026-55564","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater than cache-\u003enumber instead of greater than or equal to it. A malicious RDP server can use GLYPH_FRAGMENT_USE replay in update_process_glyph_fragments to make the default cache receive index 254 when cache-\u003enumber is 254, reading one pointer beyond the entries array and dereferencing it as a glyph. This can crash the client and may disclose adjacent heap data. This issue is fixed in version 3.27.0.","status":"published","published":"2026-07-09T00:00:00Z","modified":"2026-09-24T02:00:33.81868825Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"CLSA-2026-1791117866","title":"freerdp: Fix of 3 CVEs","description":"- CVE-2026-55564: fix out-of-bounds read in glyph_cache_get; reject an\n  index equal to the cache size\n- CVE-2026-55191: fix 32-bit integer overflow in the avc444_ensure_buffer\n  YUV444 buffer size calculation\n- CVE-2026-55192: reject H.264 frames decoded by openh264 that are smaller\n  than the context dimensions","status":"published","published":"2026-10-04T12:44:37Z","modified":"2026-10-26T09:43:27.084505579Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791184271","title":"freerdp: Fix of 3 CVEs","description":"- CVE-2026-55564: fix out-of-bounds read in glyph_cache_get; reject an\n  index equal to the cache size\n- CVE-2026-55191: fix 32-bit integer overflow in the avc444_ensure_buffer\n  YUV444 buffer size calculation\n- CVE-2026-55192: reject H.264 frames decoded by openh264 that are smaller\n  than the context dimensions","status":"published","published":"2026-10-07T00:27:03Z","modified":"2026-10-26T09:43:41.843211824Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"USN-8561-1","title":"freerdp3 vulnerabilities","description":"It was discovered that FreeRDP contained multiple security issues. An\nattacker could possibly use these issues to obtain sensitive information,\ncause FreeRDP to crash, resulting in a denial of service, or execute\narbitrary code.","status":"published","published":"2026-07-20T11:49:26Z","modified":"2026-10-01T00:17:47.242027428Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}