FreeRDP CVE-2026-55192

The victim must establish an RDP connection to an attacker-controlled or compromised server using a FreeRDP client built with H264 codec support. H264 must be negotiated for the session - if the server does not offer or the client does not accept H264, the vulnerable decompression path is never reached. The user must actively initiate or be redirected into the connection (UI:P). No authentication or privileges are required on the attacker's side since they control the server endpoint. Exploitation is limited by: (1) the requirement for active user connection to a malicious server, (2) H264 codec negotiation being in effect, and (3) the vulnerability being client-side only - server-side FreeRDP deployments are not affected by this specific flaw.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H) reflects a realistic threat model: the attacker controls or impersonates an RDP server, requires no privileges on the victim system, and needs only passive user interaction (connecting to the server). The VC:H rating indicates potential for significant memory disclosure - leaked process memory from an RDP client could include credentials or session tokens. VA:H reflects crash risk. However, this is not a zero-interaction vulnerability; a user must actively connect to the malicious server, which limits opportunistic mass exploitation. EPSS data is not present in the input, and no KEV listing exists, so exploitation likelihood must be inferred from structure alone. The vulnerability spans all four H264 backends, meaning the attack surface is broad across platforms (Linux, Android, Windows). Despite the absence of a public exploit, the network-reachable, low-complexity nature means even modest RDP server operators - such as a mid-sized municipal IT team - should treat this as a priority patch given the confidentiality impact. The integrity impact is correctly rated N since an OOB read does not modify state.

An attacker operates a malicious RDP server and social-engineers or network-redirects a victim into connecting with a FreeRDP client. Once the RDP session begins streaming H264-encoded desktop video, the server sends frames encoded with dimensions smaller than the negotiated context dimensions. The FreeRDP client's decompress() function reads beyond the allocated frame buffer, leaking process memory contents to the server-side attacker and potentially crashing the client. No public exploit has been identified at time of analysis.