CVE-2026-31897: FreeRDP has an out-of-bounds read in `freerdp_bitmap_decompress_planar`
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in freerdpbitmapdecompressplanar when SrcSize is 0. The function dereferences srcp (which points to pSrcData) without first verifying that SrcSize >= 1. When SrcSize is 0 and pSrcData is non-NULL, this reads one byte past the end of the source buffer. This vulnerability is fixed in 3.24.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31897?
CVE-2026-31897 is categorized as a medium severity vulnerability due to the potential for out-of-bounds read leading to application crashes.
How do I fix CVE-2026-31897?
To fix CVE-2026-31897, update FreeRDP to version 3.24.0 or later where the vulnerability is resolved.
What causes the out-of-bounds read in CVE-2026-31897?
The out-of-bounds read in CVE-2026-31897 is caused by the `freerdp_bitmap_decompress_planar` function attempting to dereference a pointer when the source size is zero.
Is my system affected by CVE-2026-31897?
Your system is affected by CVE-2026-31897 if you are using FreeRDP versions prior to 3.24.0.
What are the potential impacts of CVE-2026-31897?
The potential impacts of CVE-2026-31897 include application crashes and unexpected behavior in systems utilizing vulnerable versions of FreeRDP.