FreeRDP up to 3.28.0 RDP6 Planar RLE Bitmap Decoder planar.c out-of-bounds

Summaryinfo

A vulnerability, which was classified as critical, has been found in FreeRDP up to 3.28.0. This vulnerability affects the function planar_decompress_plane_rle/planar_decompress_plane_rle_only of the file libfreerdp/codec/planar.c of the component RDP6 Planar RLE Bitmap Decoder. This manipulation causes out-of-bounds. This vulnerability is tracked as CVE-2026-67306. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability has been found in FreeRDP up to 3.28.0 and classified as critical. Affected by this vulnerability is the function planar_decompress_plane_rle/planar_decompress_plane_rle_only of the file libfreerdp/codec/planar.c of the component RDP6 Planar RLE Bitmap Decoder. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planar_decompress_plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15 attacker-declared raw bytes are read without validating that the source buffer contains them. A malicious or compromised RDP server can send a truncated planar-encoded bitmap or surface update (reachable via both the Bitmap Update PDU and RDPGFX Surface Command paths) that causes the client to read past the end of the source buffer. The issue is fixed in FreeRDP 3.29.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-67306 since 07/29/2026. The exploitation appears to be easy. The attack can be launched remotely. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 3.29.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-51835). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Remote Access Software

Name

• FreeRDP

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26
• 3.27
• 3.28.0

License

• open-source

Website

• Product: https://github.com/FreeRDP/FreeRDP/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion