Junglewise Threat Intelligence

CVE-2026-26965: FreeRDP heap out-of-bounds write in RLE planar decode path

CVE-2026-26965 · Severity: high · CVSS 8.8 · Published 2026-02-25

Technologies: Red Hat Enterprise Linux, FreeRDP. Vendors: Red Hat, FreeRDP.

Executive brief

FreeRDP is an open-source implementation of the Remote Desktop Protocol used to connect to remote computers. A vulnerability in how the software processes compressed image data allows a malicious RDP server to corrupt the memory of a connecting client. If a user connects to a compromised or malicious server, the attacker could potentially take control of the user's computer or cause the application to crash.

Technical details

A heap out-of-bounds write exists in `planar_decompress_plane_rle()` due to missing destination bounds checks. While the software validates coordinates against the RDP surface, it fails to verify them against the actual destination buffer (`pTempData`) when a format mismatch triggers the use of a temporary desktop-sized buffer. An attacker-controlled RDP server can send crafted RLE planar data to trigger a write up to 132,096 bytes past the buffer end. This can be used to overwrite function pointers in adjacent structures, such as `NSC_CONTEXT->decode`, leading to arbitrary code execution. The issue is fixed in version 3.23.0 by adding RAW-equivalent destination bounds checks.

Affected products

  • FreeRDP FreeRDP < 3.23.0
  • Red Hat Enterprise Linux 7, 8, 10

Timeline

  • 2026-02-25: advisory: GitHub Security Advisory published
  • 2026-02-25: patched: Fix committed to FreeRDP repository
  • 2026-05-19: advisory: Red Hat issued security updates (RHSA-2026:19033)

References

Related threats