FreeRDP CVE-2026-69159

The victim FreeRDP client must actively initiate or be redirected to an RDP connection with a malicious or attacker-controlled RDP server - the server is the attacker's platform, not the client. No special client-side configuration is required; the vulnerability is triggered during normal planar bitmap decompression, which is part of standard RDP display processing. Exploitation is limited by the UI:R requirement: a user must connect to the malicious server, meaning passive internet exposure alone is not sufficient - active user interaction or a redirect/MITM is necessary. The vulnerability affects the client-side decode path only; RDP servers running FreeRDP are not affected by this issue.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L scores at 5.4 Medium, which appropriately reflects the attack's dependency on user interaction - the victim must actively connect to the malicious RDP server. The confidentiality impact is rated Low (adjacent memory disclosure only, not arbitrary read-anywhere), and availability impact is Low (client crash, not a persistent service disruption). No EPSS data was provided in the source intelligence, and neither a CISA KEV listing nor public proof-of-concept exploit code was identified, which aligns with the moderate base score suggesting this is currently a theoretical rather than actively weaponized risk. The practical exploitation barrier is the social engineering or man-in-the-middle requirement to redirect a victim's RDP session to an attacker-controlled server. Organizations that permit RDP connections to external or untrusted servers face meaningfully elevated risk. The absence of an integrity impact and the scoped nature of the out-of-bounds read (no confirmed code execution path) reduce urgency relative to a full remote code execution class vulnerability. Overall, this is a genuine medium-priority issue: upgrade before exposure to untrusted RDP infrastructure.

An attacker sets up a rogue RDP server and tricks a FreeRDP client user into connecting - via phishing, DNS poisoning, or a man-in-the-middle attack on an unencrypted RDP session. During the RDP session establishment or screen update phase, the server sends a crafted planar bitmap surface update whose final RLE control byte claims, for example, 12 raw bytes but only 2 remain in the packet buffer. The FreeRDP decoder reads the declared 12 bytes, overrunning into adjacent memory, potentially leaking heap contents (session tokens, process memory) back to the attacker or crashing the client process.