CVE-2026-26965
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
In FreeRDP before version 3.23.0, the `planar_decompress_plane_rle()` function lacks validation of destination buffer dimensions, allowing a malicious RDP server to perform a heap out-of-bounds write. An attacker can overwrite a function pointer in the `NSC_CONTEXT` structure, hijacking the client's control flow.
Risk Assessment
The organization is at risk of remote code execution via a malicious RDP server, potentially leading to client workstation compromise and lateral movement within the internal network.
Recommendation
Immediately upgrade FreeRDP to version 3.23.0 or later, which contains the fix for this vulnerability.
Other vulnerabilities in FreeRDP
See all- CVE-2026-23732High
FreeRDP before version 3.21.0 has a vulnerability in FastGlyph parsing where data length is not validated against the minimum size implied by cx/cy. A malicious server can trigger a client-side global buffer overflow, causing a crash (DoS).
- CVE-2026-22856High
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race in the serial channel IRP thread tracking allows a heap use‑after‑free when one thread removes an entry from serial->IrpThreads while another reads it. This vulnerability is fixed in 3.20.1.
- CVE-2013-4119High
FreeRDP before 1.1.0-beta+2013071101 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by disconnecting before authentication has finished.
- CVE-2013-4118High
FreeRDP before 1.1.0-beta1 allows remote attackers to cause a denial of service via NULL pointer dereference, leading to application crash.
- CVE-2014-0250High
Multiple integer overflows in client/X11/xf_graphics.c in FreeRDP allow remote attackers to have an unspecified impact via the width and height to the xf_Pointer_New or xf_Bitmap_Decompress function, which causes an incorrect amount of memory to be allocated.
- CVE-2026-68579Critical
FreeRDP before 3.30.0 has a heap-based buffer overflow in CliprdrStream_Read. A malicious RDP server can send an oversized response, causing an out-of-bounds write.
- CVE-2026-67305Critical
FreeRDP Windows client before version 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel when processing CLIPRDR_FILE_CONTENTS_RESPONSE PDUs without validating the server-provided size against the destination buffer. A malicious RDP server can send a response with a data payload significantly larger than requested, causing arbitrary heap memory corruption that may enable remote code execution when a user performs a paste operation.
- CVE-2026-67289Critical
FreeRDP before version 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary headers/requests into the HTTP proxy CONNECT request.
- CVE-2026-66402Critical
FreeRDP before version 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware identity validation APIs, it (1) truncates DNS SAN values at embedded NUL bytes (accepting e.g. 'victim.example\0.attacker.example' as 'victim.example'), (2) accepts a matching Common Name even when non-matching DNS SAN entries are present, and (3) accepts IP-literal targets via DNS/CN matching without comparing iPAddress SANs. Under a trusted or misissued certificate chain, an attacker positioned to present such a certificate can bypass server identity verification, weakening TLS server authentication.
- CVE-2026-64620Critical
A heap-based buffer overflow in FreeRDP before version 3.28.0 (affected <=3.27.1) in the crypto_rsa_common() function. The function writes the modular exponentiation result to the output buffer before checking bounds, allowing out-of-bounds writes.
Original NVD description (English source)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, `planar_decompress_plane_rle()` writes into `pDstData` at `((nYDst+y) * nDstStep) + (4*nXDst) + nChannel` without verifying that `(nYDst+nSrcHeight)` fits in the destination height or that `(nXDst+nSrcWidth)` fits in the destination stride. When `TempFormat != DstFormat`, `pDstData` becomes `planar->pTempData` (sized for the desktop), while `nYDst` is only validated against the **surface** by `is_within_surface()`. A malicious RDP server can exploit this to perform a heap out-of-bounds write with attacker-controlled offset and pixel data on any connecting FreeRDP client. The OOB write reaches up to 132,096 bytes past the temp buffer end, and on the brk heap (desktop ≤ 128×128), an adjacent `NSC_CONTEXT` struct's `decode` function pointer is overwritten with attacker-controlled pixel data — control-flow–relevant corruption (function pointer overwritten) demonstrated under deterministic heap layout (`nsc->decode = 0xFF414141FF414141`). Version 3.23.0 fixes the vulnerability.