diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55194.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55194.patch
new file mode 100644
index 0000000000..da2733ccf0
--- /dev/null
+++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55194.patch
@@ -0,0 +1,53 @@
+From 7e828b919a8394abd86a174c4943299618e128eb Mon Sep 17 00:00:00 2001
+From: Armin Novak <armin.novak@thincast.com>
+Date: Thu, 11 Jun 2026 08:22:26 +0200
+Subject: [PATCH] [core,gateway] ensure buffer size for current write
+
+(cherry picked from commit 9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a)
+
+CVE: CVE-2026-55194
+Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libfreerdp/core/gateway/rpc_client.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/libfreerdp/core/gateway/rpc_client.c b/libfreerdp/core/gateway/rpc_client.c
+index 27f3614f1..59e5781f4 100644
+--- a/libfreerdp/core/gateway/rpc_client.c
++++ b/libfreerdp/core/gateway/rpc_client.c
+@@ -372,7 +372,6 @@ static int rpc_client_recv_pdu(rdpRpc* rpc, RPC_PDU* pdu)
+ static int rpc_client_recv_fragment(rdpRpc* rpc, wStream* fragment)
+ {
+ 	int rc = -1;
+-	RPC_PDU* pdu = nullptr;
+ 	size_t StubOffset = 0;
+ 	size_t StubLength = 0;
+ 	RpcClientCall* call = nullptr;
+@@ -382,7 +381,7 @@ static int rpc_client_recv_fragment(rdpRpc* rpc, wStream* fragment)
+ 	WINPR_ASSERT(rpc->client);
+ 	WINPR_ASSERT(fragment);
+ 
+-	pdu = rpc->client->pdu;
++	RPC_PDU* pdu = rpc->client->pdu;
+ 	WINPR_ASSERT(pdu);
+ 
+ 	Stream_SealLength(fragment);
+@@ -464,7 +463,7 @@ static int rpc_client_recv_fragment(rdpRpc* rpc, wStream* fragment)
+ 		{
+ 			const rpcconn_response_hdr_t* response =
+ 			    (const rpcconn_response_hdr_t*)&header.response;
+-			if (!Stream_EnsureCapacity(pdu->s, response->alloc_hint))
++			if (!Stream_EnsureRemainingCapacity(pdu->s, StubLength))
+ 				goto fail;
+ 
+ 			if (Stream_Length(fragment) < StubOffset + StubLength)
+@@ -472,6 +471,7 @@ static int rpc_client_recv_fragment(rdpRpc* rpc, wStream* fragment)
+ 
+ 			if (!Stream_SetPosition(fragment, StubOffset))
+ 				goto fail;
++
+ 			Stream_Write(pdu->s, Stream_ConstPointer(fragment), StubLength);
+ 			rpc->StubFragCount++;
+ 
diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
index 4248225379..eefc9ab5d3 100644
--- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
+++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb
@@ -16,6 +16,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${
            file://CVE-2026-55191.patch \
            file://CVE-2026-55192.patch \
            file://CVE-2026-55193.patch \
+           file://CVE-2026-55194.patch \
 "