FreeRDP CVE-2026-23530

HIGH

Heap-based Buffer Overflow (CWE-122)

2026-01-19 security-advisories@github.com

Buffer Overflow Heap Overflow Freerdp

7.7

CVSS 4.0 · Vendor: github

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Lure victim to attacker RDP server
Delivery

Client connects, codec negotiates planar
Exploit

Server sends oversized bitmap dimensions
Execution

RLE decode overflows heap buffer
Impact

Client crash and heap corruption (DoS, possible RCE)

Vulnerability Assessment

Weakness	CWE CWE-122 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Heap buffer bounds checking MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the victim's FreeRDP client (any version before 3.21.0) to establish an RDP session to an attacker-controlled or compromised server that emits planar/RDP6-codec bitmap updates - the malicious server sends `nSrcWidth`/`nSrcHeight` values exceeding the negotiated `planar->maxWidth`/`maxHeight`, triggering the unchecked RLE decode write. The decisive limiting factor is directionality: this is a server-to-client attack, so the attacker cannot reach arbitrary clients unsolicited; the victim must be induced to connect outbound to the hostile server. No client-side authentication or special non-default client configuration is needed (planar codec decoding is standard), and per the CVSS vector PR:N indicates no privileges required, but the connect-out prerequisite is the real-world gate on exploitation.
Impact	Signals are mixed and point to moderate, conditional risk rather than an urgent mass-exploitation event. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VA:H, score 7.7) scores only availability impact (VC:N/VI:N/VA:H), consistent with the description framing this primarily as a DoS/crash; code execution is explicitly described as speculative and allocator-dependent, so the high score is driven by reliable crashes, not confirmed RCE. EPSS is low (0.15%, 35th percentile) and the CVE is not in CISA KEV, indicating no evidence of widespread active exploitation, even though POC/exploit code is publicly referenced in the GHSA. The key caveat is directionality: this is a server-to-client (reverse) attack - the attacker must operate or compromise an RDP server and induce a victim to connect, which the vendor vector encodes as UI:N but realistically requires the victim to initiate an outbound RDP session. That lure requirement materially limits opportunistic exploitation compared to a server-side network bug.
Exploit ScenarioDerived	An attacker stands up a malicious RDP server (or compromises a legitimate one) and lures a victim to connect, e.g., by distributing a crafted .rdp file. Once the FreeRDP client connects, the server sends a planar-encoded bitmap update declaring dimensions larger than the client's allocated codec buffer, overflowing the heap during RLE decode. The reliable outcome is a client crash (DoS); with favorable heap layout the corruption could be leveraged toward code execution, and POC code referenced in the GHSA demonstrates the trigger.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv5 – Jun 30, 2026

Client-side heap buffer overflow in FreeRDP before version 3.21.0 lets a malicious or compromised RDP server crash connecting clients and potentially corrupt heap memory. The flaw lives in the planar codec's freerdp_bitmap_decompress_planar, which fails to bound-check decoded bitmap dimensions before RLE decompression, yielding a denial-of-service with a speculative code-execution path. Publicly available exploit code exists via the GitHub Security Advisory, though EPSS exploitation probability remains low (0.15%) and it is not on CISA KEV.

Earlier versions of this analysis (4)

v4 Jun 30, 2026 - 06:09 cvss changed CVSS 7.7

Client-side heap buffer overflow in FreeRDP prior to 3.21.0 lets a malicious or compromised RDP server crash the connecting client and potentially corrupt heap memory. The flaw lives in freerdp_bitmap_decompress_planar, which fails to validate the server-supplied nSrcWidth/nSrcHeight against the codec's allocated maxWidth/maxHeight before RLE-decoding planar bitmaps. Publicly available exploit material exists (GitHub Security Advisory GHSA-r4hv-852m-fq7p); EPSS is low at 0.15% (35th percentile) and there is no public exploit identified as actively used.

v3 Jun 30, 2026 - 06:09 cvss changed CVSS 7.7

Client-side heap buffer overflow in FreeRDP before 3.21.0 allows a malicious or compromised RDP server to crash connecting clients and potentially corrupt heap memory, because freerdp_bitmap_decompress_planar fails to validate attacker-supplied nSrcWidth/nSrcHeight against the planar decoder's maxWidth/maxHeight before RLE decoding. The primary confirmed impact is denial of service (client crash), with code-execution theoretically possible depending on allocator behavior, though the vendor CVSS scores only availability impact. Publicly available exploit code exists; this is not listed in CISA KEV and carries a low EPSS score of 0.15%.

v2 Jun 30, 2026 - 06:08 cvss changed CVSS 7.7

Client-side heap buffer overflow in FreeRDP prior to 3.21.0 allows a malicious or compromised RDP server to crash a connecting client and potentially corrupt heap memory. The flaw lives in the planar codec path (freerdp_bitmap_decompress_planar), which fails to validate attacker-supplied bitmap dimensions before RLE decoding. Publicly available exploit code exists, though the issue is not listed in CISA KEV and EPSS exploitation probability remains low (0.15%, 35th percentile).

v1 Mar 12, 2026 - 21:54 CVSS 9.8

Client-side heap overflow in FreeRDP bitmap decompression enables RCE via malicious RDP servers.

RemediationAI

Vendor-released patch: FreeRDP 3.21.0 - upgrade all FreeRDP-based clients to 3.21.0 or later (see https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0 and advisory https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r4hv-852m-fq7p). For Red Hat-based systems, apply the corresponding errata (e.g., RHSA-2026:2081 / RHSA-2026:3041 at https://access.redhat.com/errata/RHSA-2026:2081) and restart affected client applications. Where immediate patching is not possible, the practical compensating control is to restrict outbound RDP: only connect to known-trusted RDP servers and block or proxy outbound TCP/3389 (and RDP-over-gateway endpoints) to untrusted hosts, accepting the trade-off that this breaks ad-hoc connections to new servers. Because exploitation requires the client to connect to a malicious server, enforcing server allow-lists and avoiding connections initiated from untrusted links (emails, documents containing .rdp files) meaningfully reduces exposure until the upgrade is deployed.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

FreeRDP is a widely used open-source implementation of the Remote Desktop Protocol (RDP). The bug is a CWE-122 heap-based buffer overflow in the planar (RDP6) bitmap codec at libfreerdp/codec/planar.c. During freerdp_bitmap_decompress_planar, the server-supplied nSrcWidth/nSrcHeight values are not validated against the codec context's allocated planar->maxWidth/maxHeight limits before the RLE decode loop writes pixel data, so an oversized declared bitmap drives writes past the bounds of the heap buffer sized for the maximum dimensions. The affected component is the RDP client decoder, meaning the trust boundary crossed is server-to-client: the server is the untrusted party feeding malformed graphics updates.

Know when Freerdp gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

vuln.today AI 6.5 MEDIUM

Server-to-client attack needs the victim to connect (UI:R); no auth on the malicious path (PR:N); confirmed impact is a client crash only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat 7.6 HIGH

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

None

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

5

Severity Changed

Jun 30, 2026 - 03:23 NVD

CRITICAL HIGH

CVSS changed

Jun 30, 2026 - 03:23 NVD

9.8 (CRITICAL) 7.7 (HIGH)

Patch released

Apr 09, 2026 - 20:30 nvd

Patch available

PoC Detected

Jan 28, 2026 - 18:53 vuln.today

Public exploit code

CVE Published

Jan 19, 2026 - 17:15 nvd

CRITICAL 9.8

DescriptionCVE.org

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,freerdp_bitmap_decompress_planar does not validate nSrcWidth/nSrcHeight against planar->maxWidth/maxHeight before RLE decode. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.

Executive ViewAI

Why It Matters

FreeRDP versions prior to 3.21.0 are vulnerable to a heap buffer overflow triggered by malicious RDP servers, enabling attackers to crash client processes and potentially execute arbitrary code on affected systems. Organizations using FreeRDP for remote desktop access face immediate disruption risk and data compromise exposure if clients connect to compromised or untrusted RDP infrastructure. A vendor patch is available; expedited deployment is required to eliminate this attack vector.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.1%

Top 65% exploitable

Prevalence

High

FreeRDP is the dominant open-source RDP client, embedded across Linux distros

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

CVE.org

EPSS Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

58

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Affected Products (CPE)CVE.org

cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*

More in Freerdp

View all

CVE-2026-25997 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth

CVE-2026-25953 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti

CVE-2026-25952 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor

CVE-2026-25959 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem

CVE-2026-22857 CRITICAL Act Now POC

FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi

CVE-2026-22854 CRITICAL Act Now POC

FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai

CVE-2026-22852 CRITICAL Act Now POC

FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m

CVE-2026-25955 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and

CVE-2024-32041 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-40574 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

CVE-2023-40569 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

CVE-2023-40567 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

Same weakness CWE-122 – Heap-based Buffer Overflow

View all

CVE-2023-4911 HIGH POC

CVE-2023-27997 CRITICAL

CVE-2026-94127 CRITICAL POC

CVE-2025-25249 CRITICAL POC

CVE-2026-85880 HIGH POC

CVE-2025-24985 HIGH POC

CVE-2026-53362 HIGH POC

CVE-2025-21418 HIGH

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2020-0796 CRITICAL POC

CVE-2019-11043 CRITICAL POC

CVE-2009-0927 HIGH POC

CVE-2012-1889 HIGH POC

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest	Affected
Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE	Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.43 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.67 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.57	Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.64 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd	Affected
SUSE Liberty Linux 8	Fixed

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2026:2048 ADVISORY https://access.redhat.com/errata/RHSA-2026:2081 ADVISORY https://access.redhat.com/errata/RHSA-2026:2222 ADVISORY https://access.redhat.com/errata/RHSA-2026:2714 ADVISORY https://access.redhat.com/errata/RHSA-2026:2736 ADVISORY https://access.redhat.com/errata/RHSA-2026:2770 ADVISORY https://access.redhat.com/errata/RHSA-2026:2824 ADVISORY https://access.redhat.com/errata/RHSA-2026:2952 ADVISORY https://access.redhat.com/errata/RHSA-2026:3036 ADVISORY https://access.redhat.com/errata/RHSA-2026:3037 ADVISORY https://access.redhat.com/errata/RHSA-2026:3038 ADVISORY https://access.redhat.com/errata/RHSA-2026:3039 ADVISORY https://access.redhat.com/errata/RHSA-2026:3041 ADVISORY https://vuldb.com/vuln/341794 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0345/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0417/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0421/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0449/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0559/ REF https://access.redhat.com/security/cve/CVE-2026-23530 REF https://bugzilla.redhat.com/show_bug.cgi?id=2430877 REF https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/planar.c#L1689-L1696 REF https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/planar.c#L1713-L1716 REF https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/planar.c#L951-L953 REF https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23530.json

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy