CVE-2026-67306

FreeRDP 3.28.0 and earlier contain an out-of-bounds read (CWE-125) in the RDP6 planar RLE bitmap decoder functions planar_decompress_plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c, where only the 1-byte control byte is bounds-checked while the 0–15 attacker-declared raw bytes that follow are read without validating that the source buffer contains them. A malicious or compromised RDP server can trigger the flaw by sending a truncated planar-encoded bitmap or surface update, which reaches the decoder through both the Bitmap Update PDU and the RDPGFX Surface Command paths. Impact is limited to client-side reads past the end of the source buffer, which can leak adjacent memory or crash the client, consistent with the medium (5.3) CVSS 4.0 score reflecting low confidentiality and availability impact, no integrity impact, and required user interaction (the user connects to the hostile server). All users running FreeRDP client versions 3.28.0 or earlier who connect to servers they do not fully trust are affected. The flaw is fixed in FreeRDP 3.29.0; it is not in CISA KEV, EPSS assigns a 0.3% 30-day exploitation probability, and one public advisory (GHSA-qrxx-7g3c-j6w3) documents the issue, so exploitation in the wild is not currently known.

What to do: Upgrade FreeRDP to 3.29.0 or later, or apply patched packages from your distribution or embedded-product vendor as they become available. Until patched, limit FreeRDP client connections to trusted RDP servers, since exploitation requires a malicious or compromised server sending a truncated planar-encoded bitmap or RDPGFX surface update. Administrators should also inventory products that embed the FreeRDP library (thin clients, remote-access appliances, remote-desktop tools) and verify the bundled version has been updated.