Alpine: multiple freerdp packages: security update to 3.27.1-r0

high Tenable Self-Hosted Container Security Plugin ID 444102

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched
with the non-default /cache:codec:rfx option pass desktop stride and height to RemoteFX decoding for Cache
Bitmap V3 data while allocating bitmap->data only for the smaller DstWidth and DstHeight in
gdi_Bitmap_Decompress, allowing a malicious RDP server to trigger a heap out-of-bounds write with
attacker-controlled offset and content. This issue is fixed in version 3.27.1. (CVE-2026-55827)

- FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that
negotiate RDPGFX AVC444 with an H.264 decoder backend calculate the intermediate YUV444 allocation size in
libfreerdp/codec/h264.c with 32-bit multiplication in avc444_ensure_buffer. A malicious RDP server can
supply surface dimensions for which piDstStride multiplied by padDstHeight wraps to a small nonzero value,
causing winpr_aligned_recalloc to allocate an undersized buffer before YUV420CombineToYUV444 writes using
the actual stride and rectangle dimensions. This can cause a client crash and may permit code execution
through attacker-influenced heap corruption. This issue is fixed in version 3.27.0. (CVE-2026-55191)

- FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder
backends can return YUV planes sized from the bitstream without comparing the decoded width and height to
the RDPGFX surface dimensions used to validate region rectangles. A malicious RDP server can provide an
AVC420 or AVC444 bitstream whose decoded frame is smaller than the negotiated surface, causing
yuv420_context_decode and the YUV-to-RGB conversion paths to read beyond the decoder-owned planes in
libfreerdp/codec/h264.c and the selected H.264 backend. This can disclose client memory or crash the
client. This issue is fixed in version 3.27.0. (CVE-2026-55192)

- FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients using TS
Gateway accept a server-controlled max_xmit_frag value in libfreerdp/core/gateway/rpc_bind.c without
bounding it to the 4088-byte ReceiveFragment allocation. A malicious gateway can advertise 65535 and then
send a response fragment of the same length, causing rpc_channel_read in libfreerdp/core/gateway/rpc.c to
write up to 65535 bytes into the smaller ReceiveFragment buffer. This can crash the client and may permit
code execution through attacker-controlled heap corruption. This issue is fixed in version 3.27.0.
(CVE-2026-55193)

- FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment
in libfreerdp/core/gateway/rpc_client.c ensures the response reassembly stream capacity using only the
server-declared alloc_hint rather than the actual StubLength about to be written. A malicious TS Gateway
can send a PTYPE_RESPONSE with a small alloc_hint and a much larger frag_length, causing Stream_Write to
copy attacker-controlled stub data beyond the 4096-byte pdu->s buffer. This can crash the client and may
permit code execution through heap corruption. This issue is fixed in version 3.27.0. (CVE-2026-55194)

Solution

Update the freerdp library and its related packages to version 3.27.1-r0 or later.

Plugin Details

Severity: High

ID: 444102

Version: Revision 1.5

Type: Local

Family: Alpine Linux Local Security Checks

Published: 6/29/2026

Updated: 8/20/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.17

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-55827

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 7.4

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-55194

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 6/18/2026

Reference Information

CVE: CVE-2026-55191, CVE-2026-55192, CVE-2026-55193, CVE-2026-55194, CVE-2026-55648, CVE-2026-55827

Detections

Analytics