Which versions of FreeRDP are affected by CVE-2026-55193?

FreeRDP versions before 3.27.0 contain a heap buffer overflow exploitable by a compromised gateway server to achieve arbitrary code execution on clients-no public exploit identified at time of…. A patch is available.

How to fix or mitigate CVE-2026-55193?

Within 24 hours, conduct an inventory of all FreeRDP installations and versions across your organization, and subscribe to FreeRDP project advisories for patch notifications. Within 7 days, implement strict network access controls limiting RDP gateway connectivity to authorized administrative hosts, and evaluate the operational necessity of the RPC-over-HTTP component-disable if not required. Within 30 days, apply FreeRDP version 3.27.0 or later (upstream) or Alpine freerdp 3.27.1-r0 or later as soon as released, and conduct security assessments of RDP gateway infrastructure for evidence of compromise.

FreeRDP CVE-2026-55193

Q: What is the CVSS score of CVE-2026-55193?

CVE-2026-55193 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-62664 HIGH

Heap-based Buffer Overflow (CWE-122)

N/A vendor:alpine

Buffer Overflow Heap Overflow

8.7

CVSS 4.0 · Vendor: vendor:alpine

Severity by source

Vendor (vendor:alpine) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Attacker controls the server requiring no privileges; user must initiate gateway connection (UI:R); scope unchanged as impact is confined to the client process.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vendor:alpine).

CVSS VectorVendor: vendor:alpine

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Aug 19, 2026 - 19:18 EUVD

Source Code Evidence Fetched

Aug 19, 2026 - 18:31 vuln.today

Analysis Updated

Aug 19, 2026 - 18:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 19, 2026 - 18:22 vuln.today

cvss_changed

CVSS changed

Aug 19, 2026 - 18:22 NVD

8.7 (HIGH)

Analysis Generated

Jun 29, 2026 - 13:31 vuln.today

DescriptionCVE.org

Alpine Linux: freerdp fixed in 3.27.1-r0

AnalysisAI

Heap-based buffer overflow in FreeRDP's RPC-over-HTTP gateway handler allows a malicious or compromised RDP gateway server to corrupt heap memory on a connecting client by sending an oversized fragment size value in a bind_ack PDU response. Affected are FreeRDP versions prior to 3.27.0 upstream and Alpine Linux freerdp prior to 3.27.1-r0. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the victim FreeRDP client be configured to connect through an RDP gateway (RPC-over-HTTP mode) rather than via a direct RDP connection - the vulnerable `rpc_recv_bind_ack_pdu` function is only invoked in gateway sessions. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) scores 8.7, reflecting network accessibility, low attack complexity, no privilege requirement, passive user interaction, and high impact on all three CIA triad components. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade FreeRDP to version 3.27.0 or later using the upstream release at https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, conduct an inventory of all FreeRDP installations and versions across your organization, and subscribe to FreeRDP project advisories for patch notifications. …

Threat intelligence, references, and detailed analysis are available after sign-in.