FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's planar bitmap decoder has an out-of-bounds heap write when decoding RLE planar data. In libfreerdp/codec/planar.c, freerdp_bitmap_decompress_planar() validates the X destination coordinate nXDst against the caller-provided destination stride (nDstStep) even when it is writing into the internal temp buffer pTempData. An attacker can bypass the check with a large nDstStep and a large nXDst, causing planar_decompress_plane_rle() to write past the end of pTempData. This vulnerability is fixed in 3.26.0.
CVSS Details
- CVSS 4.0 Base Score: 7.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libwinprUpgrade libwinpr-develUpgrade freerdp-develUpgrade freerdpUpgrade freerdp-libs | Jul 13, 2026 | Jul 9, 2026 |
| Amazon Linux Ami 2 | — | Upgrade libwinprUpgrade freerdp-debuginfoUpgrade freerdp-libsUpgrade libwinpr-develUpgrade freerdp-develUpgrade freerdp | Jun 23, 2026 | Jun 23, 2026 |
| Amazon_linux_2023 | — | Upgrade freerdp-libs-debuginfoUpgrade freerdp-libsUpgrade freerdp-serverUpgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade libwinpr-debuginfoUpgrade freerdp-debuginfoUpgrade freerdpUpgrade freerdp-server-debuginfoUpgrade libwinprUpgrade freerdp-devel | Jun 23, 2026 | May 29, 2026 |
| Redhat_linux | — | Upgrade freerdp-libsNo solution existsUpgrade libwinpr-debuginfoUpgrade freerdp-libs-debuginfoUpgrade libwinprUpgrade freerdp-develUpgrade freerdp-serverUpgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade freerdpUpgrade freerdp-debuginfoUpgrade freerdp-server-debuginfo | Jul 9, 2026 | May 29, 2026 |
| Rocky_linux | — | Upgrade freerdp-develUpgrade freerdp-server-debuginfoUpgrade freerdp-libsUpgrade freerdp-libs-debuginfoUpgrade freerdp-serverUpgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade libwinpr-debuginfoUpgrade libwinprUpgrade freerdp-debuginfoUpgrade freerdp | Jul 10, 2026 | Jul 8, 2026 |
| Ubuntu | — | Upgrade libfreerdp2-2t64 (Ubuntu Pro)Upgrade libfreerdp2-2 (Ubuntu Pro)Upgrade freerdp2-x11Upgrade freerdp3-x11Upgrade freerdp-x11Upgrade libfreerdp2-2Upgrade freerdp2-x11 (Ubuntu Pro)Upgrade libfreerdp3-3 | Jun 16, 2026 | Jun 16, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub