CVE-2026-69159
MediumCVSS 5.4Summary
FreeRDP prior to 3.29.0 has a vulnerability in planar_decompress_plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c. These functions verify that a control byte exists but do not verify that the source buffer contains the zero to fifteen raw bytes declared by that control byte. A malicious RDP server can send a truncated planar bitmap or surface update whose final control byte claims additional raw bytes, causing the decoder to read beyond pSrcData while processing a color plane. This can crash the client and may disclose adjacent memory. This issue is fixed in version 3.29.0.
Risk Assessment
The risk includes RDP client crashes and potential memory disclosure, which could compromise data confidentiality and affect service availability.
Recommendation
It is recommended to upgrade FreeRDP to version 3.29.0 or later, which includes the fix. Also, monitor RDP connections for suspicious servers.
Original NVD description (English source)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.29.0, planar_decompress_plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c verify that a control byte exists but do not verify that the source buffer contains the zero to fifteen raw bytes declared by that control byte. A malicious RDP server can send a truncated planar bitmap or surface update whose final control byte claims additional raw bytes, causing the decoder to read beyond pSrcData while processing a color plane. This can crash the client and may disclose adjacent memory. This issue is fixed in version 3.29.0.