CVE-2026-67306 Details
Description
FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planar_decompress_plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15 attacker-declared raw bytes are read without validating that the source buffer contains them. A malicious or compromised RDP server can send a truncated planar-encoded bitmap or surface update (reachable via both the Bitmap Update PDU and RDPGFX Surface Command paths) that causes the client to read past the end of the source buffer. The issue is fixed in FreeRDP 3.29.0.
A out-of-bounds read vulnerability has been identified in FreeRDP versions through 3.28.0. The issue resides in the RDP6 planar RLE bitmap decoder, specifically within the functions 'planar_decompress_plane_rle' and 'planar_decompress_plane_rle_only' in 'libfreerdp/codec/planar.c'. The vulnerability occurs because only the 1-byte control byte is properly bounds-checked; the following 0-15 attacker-declared raw bytes are read without any validation of the source buffer. This flaw allows a malicious or compromised RDP server to send a truncated planar-encoded bitmap or surface update, causing the FreeRDP client to read past the end of the source buffer. This vulnerability can be exploited after a connection is established, via both the Bitmap Update PDU and RDPGFX Surface Command paths.
Users can upgrade to FreeRDP version 3.29.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qrxx-7g3c-j6w3 | CISA-ADP | ExploitPatchVendor Advisory |
| https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f | [email protected] | Patch |
| https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qrxx-7g3c-j6w3 | [email protected] | ExploitPatchVendor Advisory |
| https://www.vulncheck.com/advisories/freerdp-before-out-of-bounds-read-via-planar-rle | [email protected] | PatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freerdp freerdp | < 3.28.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | Initial Analysis | [email protected] |
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 1, 2026 | New CVE Received | [email protected] |