CVE-2026-45700
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
FreeRDP prior to 3.26.0 has an out-of-bounds heap write in the planar bitmap decoder. An attacker can bypass coordinate validation and write past the internal buffer.
Risk Assessment
This could lead to remote code execution or RDP service crash, threatening system confidentiality and integrity.
Recommendation
Immediately upgrade FreeRDP to version 3.26.0 or later.
Original NVD description (English source)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's planar bitmap decoder has an out-of-bounds heap write when decoding RLE planar data. In libfreerdp/codec/planar.c, freerdp_bitmap_decompress_planar() validates the X destination coordinate nXDst against the caller-provided destination stride (nDstStep) even when it is writing into the internal temp buffer pTempData. An attacker can bypass the check with a large nDstStep and a large nXDst, causing planar_decompress_plane_rle() to write past the end of pTempData. This vulnerability is fixed in 3.26.0.