Freerdp CVE-2026-26965

HIGH

Out-of-bounds Write (CWE-787)

2026-02-25 security-advisories@github.com

Buffer Overflow Memory Corruption Freerdp

8.8

CVSS 3.1 · Vendor: github

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Malicious RDP server sends crafted planar RLE compressed bitmap
Delivery

FreeRDP client receives decompression request
Exploit

planar_decompress_plane_rle() writes beyond allocated buffer
Execution

Heap corruption occurs
Impact

Arbitrary code execution or crash

Vulnerability Assessment

Weakness	CWE CWE-787 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, write limits MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	FreeRDP versions prior to 3.23.0 with RLE planar decompression enabled. Requires user to connect to malicious RDP server (AV:N/AC:L/PR:N/UI:R). Vulnerable when TempFormat differs from DstFormat and nYDst validation bypasses temp buffer bounds checking.
Impact	CVSS 8.8 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: Required. Exploitable via remote/network. Public exploit/POC available.
Exploit ScenarioDerived	A remote attacker could exploit this vulnerability to compromise the affected system.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Mar 12, 2026

FreeRDP is a free implementation of the Remote Desktop Protocol. [CVSS 8.8 HIGH]

RemediationAI

A vendor patch is available — apply it immediately. Enable ASLR, DEP/NX, and stack canaries where possible. Restrict network access to the affected service where possible.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

Classified as CWE-787 (Out-of-bounds Write). Affects Freerdp. FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, planar_decompress_plane_rle() writes into pDstData at ((nYDst+y) * nDstStep) + (4*nXDst) + nChannel without verifying that (nYDst+nSrcHeight) fits in the destination height or that (nXDst+nSrcWidth) fits in the destination stride. When TempFormat != DstFormat, pDstData becomes planar->pTempData (sized for the desktop), while nYDst is only validated against th

Know when Freerdp gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE HIGH

Red Hat 8.8 HIGH

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

3

PoC Detected

Feb 27, 2026 - 14:49 vuln.today

Public exploit code

Patch released

Feb 27, 2026 - 14:49 nvd

Patch available

CVE Published

Feb 25, 2026 - 21:16 nvd

HIGH 8.8

DescriptionCVE.org

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, planar_decompress_plane_rle() writes into pDstData at ((nYDst+y) * nDstStep) + (4*nXDst) + nChannel without verifying that (nYDst+nSrcHeight) fits in the destination height or that (nXDst+nSrcWidth) fits in the destination stride. When TempFormat != DstFormat, pDstData becomes planar->pTempData (sized for the desktop), while nYDst is only validated against the surface by is_within_surface(). A malicious RDP server can exploit this to perform a heap out-of-bounds write with attacker-controlled offset and pixel data on any connecting FreeRDP client. The OOB write reaches up to 132,096 bytes past the temp buffer end, and on the brk heap (desktop ≤ 128×128), an adjacent NSC_CONTEXT struct's decode function pointer is overwritten with attacker-controlled pixel data - control-flow-relevant corruption (function pointer overwritten) demonstrated under deterministic heap layout (nsc->decode = 0xFF414141FF414141). Version 3.23.0 fixes the vulnerability.

Executive ViewAI

Why It Matters

A critical remote code execution vulnerability in FreeRDP (CVSS 8.8) could allow attackers to compromise systems using this remote desktop software. Organizations relying on FreeRDP for remote access or virtual desktop infrastructure face elevated risk of unauthorized system access and data breach. Immediate patching is required to prevent potential exploitation.

Business Impact: High

Compensating Controls

Apply vendor patch. If immediate patching is not feasible: implement network segmentation to restrict FreeRDP access to trusted networks only, disable FreeRDP services on non-essential systems, enforce strict firewall rules limiting RDP connectivity, and require multi-factor authentication for all remote access sessions.

Threat Intelligence Overview

EPSS Score

0.1%

Top 83% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

CVE.org

EPSS Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

No

Human Impact

High

Priority Score

64

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Affected Products (CPE)CVE.org

cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*

More in Freerdp

View all

CVE-2026-25997 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth

CVE-2026-25953 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti

CVE-2026-25952 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor

CVE-2026-25959 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem

CVE-2026-22857 CRITICAL Act Now POC

FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi

CVE-2026-22854 CRITICAL Act Now POC

FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai

CVE-2026-22852 CRITICAL Act Now POC

FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m

CVE-2026-25955 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and

CVE-2024-32041 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-40574 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

CVE-2023-40569 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

CVE-2023-40567 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

Same weakness CWE-787 – Out-of-bounds Write

View all

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2012-1889 HIGH POC

CVE-2010-3333 HIGH POC

CVE-2014-1761 HIGH POC

CVE-2009-3129 HIGH POC

CVE-2021-1732 HIGH POC

CVE-2013-3346 CRITICAL POC

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2020-0796 CRITICAL POC

CVE-2019-11043 CRITICAL POC

CVE-2009-0927 HIGH POC

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 SUSE Linux Enterprise Workstation Extension 15 SP7	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
SUSE Linux Enterprise Server 12 SP5-LTSS	Fixed

References

Advisories & patches

PATCH https://github.com/FreeRDP/FreeRDP/commit/a0be5cb87d760bb1c803ad1bb835aa1e73e62abc ADVISORY https://access.redhat.com/errata/RHSA-2026:5936 ADVISORY https://access.redhat.com/errata/RHSA-2026:5939 ADVISORY https://access.redhat.com/errata/RHSA-2026:6004 ADVISORY https://access.redhat.com/errata/RHSA-2026:6005 ADVISORY https://access.redhat.com/errata/RHSA-2026:6384 ADVISORY https://access.redhat.com/errata/RHSA-2026:6385 ADVISORY https://access.redhat.com/errata/RHSA-2026:6395 ADVISORY https://access.redhat.com/errata/RHSA-2026:6396 ADVISORY https://access.redhat.com/errata/RHSA-2026:6616 ADVISORY https://access.redhat.com/errata/RHSA-2026:6665 ADVISORY https://access.redhat.com/errata/RHSA-2026:6712 ADVISORY https://access.redhat.com/errata/RHSA-2026:6764 ADVISORY https://access.redhat.com/errata/RHSA-2026:7292 ADVISORY https://vuldb.com/vuln/347869 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1129/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1160/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1164/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1165/ REF https://access.redhat.com/errata/RHSA-2026:19033 REF https://access.redhat.com/security/cve/CVE-2026-26965 REF https://bugzilla.redhat.com/show_bug.cgi?id=2442959 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26965.json

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy