CVE-2026-67306 in FreeRDP
Summary
by MITRE • 08/01/2026
FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planar_decompress_plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15 attacker-declared raw bytes are read without validating that the source buffer contains them. A malicious or compromised RDP server can send a truncated planar-encoded bitmap or surface update (reachable via both the Bitmap Update PDU and RDPGFX Surface Command paths) that causes the client to read past the end of the source buffer. The issue is fixed in FreeRDP 3.29.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
This vulnerability resides within the FreeRDP library's bitmap decoding functionality, specifically affecting versions 3.28.0 and earlier. The flaw manifests in the RDP6 planar RLE bitmap decoder where two critical functions planar_decompress_plane_rle and planar_decompress_plane_rle_only fail to properly validate buffer boundaries. The vulnerability stems from an incomplete bounds-checking mechanism that only validates a single 1-byte control byte while neglecting to verify that subsequent 0-15 raw bytes declared by the attacker are actually present in the source buffer. This fundamental oversight creates a classic out-of-bounds read condition that can be exploited through carefully crafted malicious RDP server responses.
The technical implementation of this vulnerability follows established patterns found in CWE-129, which describes improper validation of array indices, and aligns with ATT&CK technique T1059.007 for command and scripting interpreter. When a malicious or compromised RDP server sends a truncated planar-encoded bitmap or surface update, the client processes these packets without adequate buffer boundary checks. The vulnerability is accessible through both the Bitmap Update PDU and RDPGFX Surface Command paths, providing multiple attack vectors that can be leveraged by threat actors. The attacker-controlled 1-byte control byte dictates how many additional raw bytes should be read, but since these bytes are not validated against the actual buffer size, the client reads beyond intended memory boundaries.
The operational impact of this vulnerability extends beyond simple data corruption or application crashes. An attacker positioned between a FreeRDP client and server can potentially execute arbitrary code through information disclosure or privilege escalation scenarios, particularly when the client operates in environments with elevated privileges. The out-of-bounds read could expose sensitive memory contents including cryptographic keys, session tokens, or other confidential data that might be accessible through memory layout analysis. Furthermore, this vulnerability affects systems running FreeRDP versions prior to 3.29.0, making it a widespread concern across various enterprise environments that rely on RDP connectivity for remote desktop services and virtual desktop infrastructure implementations.
Mitigation strategies should prioritize immediate patching to FreeRDP version 3.29.0 or later where the vulnerability has been addressed through proper buffer validation mechanisms. Organizations should implement network segmentation and monitoring to detect unusual RDP traffic patterns that might indicate exploitation attempts. Additional defensive measures include implementing strict firewall rules that limit RDP access to trusted networks, enabling multi-factor authentication for RDP sessions, and conducting regular security assessments of remote desktop environments to identify potential attack vectors. The fix in version 3.29.0 demonstrates proper bounds checking implementation that validates all bytes read from the source buffer against available data, preventing the out-of-bounds memory access that previously enabled exploitation of this vulnerability.