Junglewise Threat Intelligence

CVE-2026-23530: FreeRDP heap buffer overflow in freerdp_bitmap_decompress_planar

CVE-2026-23530 · Severity: critical · CVSS 9.8 · Published 2026-01-19

Technologies: Red Hat Enterprise Linux, FreeRDP. Vendors: Red Hat, FreeRDP.

Executive brief

FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) used to connect to remote computers. A vulnerability in how it handles image decompression allows a malicious server to crash the client application or potentially execute unauthorized code on the user's machine. This could lead to a complete compromise of the workstation used to initiate the remote desktop session.

Technical details

A heap-based buffer overflow exists in the `freerdp_bitmap_decompress_planar` function within `libfreerdp/codec/planar.c`. The vulnerability is caused by a failure to validate `nSrcWidth` and `nSrcHeight` against the `maxWidth` and `maxHeight` stored in the planar context before performing RLE (Run-Length Encoding) decoding. Because buffer allocation is tied to the context's maximum dimensions during a reset, a malicious server can provide bitmap headers with larger dimensions, causing `planar_decompress_plane_rle` to write past the bounds of the allocated `pTempData` or `rlePlanesBuffer`. This can result in a denial of service (crash) or arbitrary code execution. The issue is fixed in version 3.21.0.

Affected products

  • FreeRDP FreeRDP < 3.21.0
  • Red Hat Enterprise Linux 7, 8, 10.0

Timeline

  • 2026-01-19: disclosed
  • 2026-01-19: patched: Fixed in version 3.21.0
  • 2026-01-19: advisory

References

Related threats