Logo
›
›vulnerability›CVE-2026-23530
Name
CVE-2026-23530
Source
NVD ( link)Debian ( link)
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrcHeight` against `planar->maxWidth`/`maxHeight` before RLE decode. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
CWEs
CWE-122
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/planar.c#L1689-L1696Product
https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/planar.c#L1713-L1716Product
https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/planar.c#L951-L953Product
https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0Release Notes
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r4hv-852m-fq7pExploit

Analysis#

Affected Component
Analysis
freerdp
Patched

Vulnerability Ratings#

7.7
CVSSv4
9.8
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
freerdp
buildroot
2025.02.x
2.11.8
Patched
freerdp
yocto
kirkstone
2.6.1
Exploitable
freerdp
yocto
master
2.11.8
Patched
freerdp3
yocto
master
3.26.0
Patched
freerdp
yocto
scarthgap
2.11.8
Exploitable
freerdp3
yocto
scarthgap
3.4.0
Exploitable

Resolved with patches#

freerdp (buildroot:2025.02.x)

#
Title
Author
Resolve
1
[codec,planar] fix decoder length checks
akallabeth <akallabeth@posteo.net>
CVE-2026-23530

freerdp (buildroot:master)

#
Title
Author
Resolve
1
[codec,planar] fix decoder length checks
akallabeth <akallabeth@posteo.net>
CVE-2026-23530

freerdp (yocto:master)

#
Title
Author
Resolve
1
fix decoder length checks
akallabeth <akallabeth@posteo.net>
CVE-2026-23530