Executive brief
FreeRDP is an open-source implementation of the Remote Desktop Protocol used to connect to remote computers. A security flaw in how the software processes graphics data allows a malicious server to trigger a memory error on a user's computer. This could lead to a program crash or potentially allow the server to read small amounts of sensitive information from the user's memory.
Technical details
An out-of-bounds (OOB) read exists in `libfreerdp/codec/planar.c` within the `planar_decompress_plane_rle_only` function. The vulnerability is an incomplete fix for CVE-2026-23530, where the code dereferences the source pointer `srcp` to read a control byte before validating that the pointer is within the allocated `SrcSize`. An attacker controlling a malicious RDP server can send a truncated `RDPGFX_CMDID_WIRETOSURFACE_1` planar payload. On the final pixel processing loop, this causes a one-byte read past the input buffer, potentially leading to a denial of service (crash) or information disclosure. The issue is resolved in version 3.28.0 by reordering the bounds check to occur before the dereference.
Affected products
- FreeRDP FreeRDP >= 3.21.0, < 3.28.0
Timeline
- 2026-06-23: patched: Fix merged into master branch
- 2026-07-06: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: CVE published to NVD