CVE-2026-69159: FreeRDP: Out-of-Bounds Read in Planar RLE Decoder (planar_decompress_plane_rle / planar_decompress_plane_rle_only)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.29.0, planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c verify that a control byte exists but do not verify that the source buffer contains the zero to fifteen raw bytes declared by that control byte. A malicious RDP server can send a truncated planar bitmap or surface update whose final control byte claims additional raw bytes, causing the decoder to read beyond pSrcData while processing a color plane. This can crash the client and may disclose adjacent memory. This issue is fixed in version 3.29.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDP (libfreerdp/codec/planar.c planar_decompress_plane_rle / planar_decompress_plane_rle_only)to a version that resolves this vulnerability.Fixed in 3.29.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRDP clients that process planar bitmap or surface updates from an RDP server are exposed if they use a version before 3.29.0. A malicious RDP server can trigger the issue remotely.
What does an attacker need to do to exploit it?
The attacker needs to cause the client to process a truncated planar bitmap or surface update whose final control byte declares additional raw bytes that are not present. User interaction is required according to the supplied CVSS vector.
What is the impact on an affected client?
The out-of-bounds read can crash the FreeRDP client and may disclose memory adjacent to the source buffer. The provided severity vector indicates low confidentiality and low availability impact, with no integrity impact.
How can this be remediated?
Upgrade FreeRDP to version 3.29.0 or later, where the planar RLE decoder validates that the raw bytes declared by the control byte are available.