Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-55192

CVE-2026-55192HIGH

FreeRDP: Out-of-bounds read in H.264 YUV-to-RGB conversion due to decoder/surface dimension mismatch

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   H   N   H    7.2   .0045   36.8     —

AFFECTED
  Product  Versions    Fixed
  FreeRDP  < 3.27.0 –  —

TIMELINE
  Jun 16  Reserved by GitHub_M
  Aug 19  Published (CNA: GitHub_M)
  Sep 22  EXPLOIT PUBLISHED — CVE-2026-55192 (FreeRDP). Public exploit reference added.

CWE-125 · CNA: GitHub_M · CVSS v4.0 · 4 references · NVD status: Analyzed

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder backends can return YUV planes sized from the bitstream without comparing the decoded width and height to the RDPGFX surface dimensions used to validate region rectangles. A malicious RDP server can provide an AVC420 or AVC444 bitstream whose decoded frame is smaller than the negotiated surface, causing yuv420_context_decode and the YUV-to-RGB conversion paths to read beyond the decoder-owned planes in libfreerdp/codec/h264.c and the selected H.264 backend. This can disclose client memory or crash the client. This issue is fixed in version 3.27.0.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
June 16, 2026	Reserved	Reserved by GitHub_M
August 19, 2026	Published	Published (CNA: GitHub_M)
September 22, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-55192 (FreeRDP). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
FreeRDP	FreeRDP	—	< 3.27.0	—

Weaknesses

CWE-125

References (4)

https://github.com/FreeRDP/FreeRDP/commit/0cd45b70bb1fe6befd258ff64c46461947e99adb [Patch]
https://github.com/FreeRDP/FreeRDP/pull/12873 [Issue Tracking, Patch]
https://github.com/FreeRDP/FreeRDP/releases/tag/3.27.0 [Release Notes]
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3mmf-qh4f-frm6 [Exploit, Mitigation, Vendor Advisory]

Authoritative record: CVE-2026-55192 at cve.org

Vendors: freerdp

Weaknesses: CWE-125

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-55192 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.