Executive brief
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) used to connect to remote computers. A flaw in how it processes image data allows a malicious server to corrupt the memory of a connecting client. This could lead to the application crashing or potentially allow the attacker to execute unauthorized code on the user's system.
Technical details
A heap-based buffer overflow exists in `libfreerdp/codec/planar.c` within the `freerdp_bitmap_decompress_planar()` function. The root cause is an incorrect bounds check where the destination X-coordinate (`nXDst`) is validated against a caller-provided stride (`nDstStep`) instead of the internal temporary buffer's stride (`nTempStep`). An attacker controlling a malicious RDP server can provide large values for these parameters to bypass the check, causing `planar_decompress_plane_rle()` to write past the end of the `pTempData` buffer. This can result in heap corruption, leading to a crash or potential arbitrary code execution. The issue is fixed in version 3.26.0.
Affected products
- FreeRDP FreeRDP < 3.26.0
Timeline
- 2026-05-12: advisory: GitHub advisory published by maintainers
- 2026-05-29: disclosed: NVD publication date
- 2026-05-29: patched: Fix identified in version 3.26.0