Skip to main content

FreeRDP CVE-2026-67306

| EUVDEUVD-2026-51835 MEDIUM
Out-of-bounds Read (CWE-125)
2026-08-01 VulnCheck GHSA-3j62-96cj-jq88
Buffer Overflow Information Disclosure Freerdp
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.4 MEDIUM

Network vector with no attacker-side privilege requirement; user interaction required to initiate RDP session; impact limited to client-side read leak and potential crash with no integrity effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.4 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Red Hat
5.4 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 01, 2026 - 13:31 vuln.today
Analysis Generated
Aug 01, 2026 - 13:31 vuln.today
CVE Published
Aug 01, 2026 - 12:22 cve.org
MEDIUM 5.3

DescriptionCVE.org

FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planar_decompress_plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0-15 attacker-declared raw bytes are read without validating that the source buffer contains them. A malicious or compromised RDP server can send a truncated planar-encoded bitmap or surface update (reachable via both the Bitmap Update PDU and RDPGFX Surface Command paths) that causes the client to read past the end of the source buffer. The issue is fixed in FreeRDP 3.29.0.

AnalysisAI

Out-of-bounds read in FreeRDP 3.28.0 and earlier allows a malicious or compromised RDP server to leak client-side memory contents or crash the FreeRDP process by sending a crafted truncated planar-encoded bitmap or surface update. The flaw lives in the RDP6 planar RLE decoder (libfreerdp/codec/planar.c), where attacker-declared raw byte counts of 0-15 bytes following a bounds-checked control byte are consumed without verifying remaining buffer space. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; FreeRDP 3.29.0 contains the confirmed vendor patch.

Technical ContextAI

FreeRDP (CPE: cpe:2.3:a:freerdp:freerdp) is an open-source implementation of Microsoft's Remote Desktop Protocol, widely integrated into Linux desktop environments, thin clients, and downstream enterprise products. The root cause is CWE-125 (Out-of-bounds Read) in the RDP6 planar RLE bitmap codec, specifically in planar_decompress_plane_rle and planar_decompress_plane_rle_only within libfreerdp/codec/planar.c. The decoder reads a 1-byte control byte and interprets its lower nibble as the count of subsequent raw bytes to copy. While the control byte read is bounds-checked, the 0-15 raw bytes that follow are consumed without first confirming the source buffer has that many bytes remaining, producing a classic length-before-check antipattern (CWE-125). Critically, this code is reachable through two distinct protocol channels: the legacy Bitmap Update PDU and the newer RDPGFX Surface Command path (RDP Graphics Pipeline Extension), which broadens the attack surface beyond older graphics modes. The fix is referenced in GitHub Security Advisory GHSA-qrxx-7g3c-j6w3 and patch commit 5370fb26fbf034ecd11d3026b6ad639b5fff493f.

RemediationAI

Upgrade to FreeRDP 3.29.0, which contains the vendor-released patch confirmed by GitHub Security Advisory GHSA-qrxx-7g3c-j6w3 (https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qrxx-7g3c-j6w3) and patch commit https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f. For environments unable to upgrade immediately, restricting FreeRDP clients to connecting only to known-trusted, internally administered RDP servers eliminates the primary threat model (malicious server sending crafted bitmaps) with no functional trade-off for controlled environments. As a partial mitigation, disabling the RDPGFX channel via the /gfx:off command-line flag removes the RDPGFX Surface Command attack path, though the legacy Bitmap Update PDU path remains exploitable and the overall vulnerability is not fully mitigated. Downstream Linux distribution packages should be updated as vendor-backported patches are released.

More in Freerdp

View all
CVE-2026-25997 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth

CVE-2026-25953 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti
CVE-2026-25952 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor
CVE-2026-25959 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem
CVE-2026-22857 CRITICAL POC
9.8 Jan 14

FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi
CVE-2026-22854 CRITICAL POC
9.8 Jan 14

FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai
CVE-2026-22852 CRITICAL POC
9.8 Jan 14

FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m
CVE-2026-25955 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and

CVE-2024-32041 CRITICAL POC
9.8 Apr 22

FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-40574 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40569 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40567 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected

Share

CVE-2026-67306 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy