Is CVE-2026-23530 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-23530 being exploited in the wild.

How severe is CVE-2026-23530?

Critical severity, with a CVSS score of 9.8, published 19 January 2026.

Is there a fix for CVE-2026-23530?

A patch was published on 2026-01-19: Fixed in version 3.21.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-23530 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-23530?

Check whether you run FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-23530: FreeRDP heap buffer overflow in freerdp_bitmap_decompress_planar

CVE-2026-23530 · Severity: critical · CVSS 9.8 · Published 2026-01-19

FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) used to connect to remote computers. A vulnerability in how it handles image decompression allows a malicious server to crash the client application or potentially execute unauthorized code on the user's machine. This could lead to a complete compromise of the workstation used to initiate the remote desktop session.

Technologies: FreeRDP. Vendors: FreeRDP.

Quick answers

Is CVE-2026-23530 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-23530 being exploited in the wild.
How severe is CVE-2026-23530?: Critical severity, with a CVSS score of 9.8, published 19 January 2026.
Which products and versions are affected?: FreeRDP < 3.21.0.
Is there a fix for CVE-2026-23530?: A patch was published on 2026-01-19: Fixed in version 3.21.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23530 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-23530?: Check whether you run FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in the `freerdp_bitmap_decompress_planar` function within `libfreerdp/codec/planar.c`. The vulnerability is caused by a failure to validate `nSrcWidth` and `nSrcHeight` against the `maxWidth` and `maxHeight` stored in the planar context before performing RLE (Run-Length Encoding) decoding. Because buffer allocation is tied to the context's maximum dimensions during a reset, a malicious server can provide bitmap headers with larger dimensions, causing `planar_decompress_plane_rle` to write past the bounds of the allocated `pTempData` or `rlePlanesBuffer`. This can result in a denial of service (crash) or arbitrary code execution. The issue is fixed in version 3.21.0.

Affected products

FreeRDP FreeRDP < 3.21.0
Red Hat Enterprise Linux 7, 8, 10.0

Timeline

2026-01-19: disclosed
2026-01-19: patched: Fixed in version 3.21.0
2026-01-19: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.