CVE-2026-57158

CriticalCVSS 9.1

Published: 10/07/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.69%

49th percentile - higher than 49% of all known CVEs

Summary

FreeRDP versions 3.21.0 through 3.27.9 contain an incomplete fix for CVE-2026-23530 in the planar_decompress_plane_rle_only function in planar.c. A malicious RDP server can send a crafted planar RDPGFX_CMDID_WIRETOSURFACE_1 payload that reads one byte past the input buffer.

Risk Assessment

A malicious RDP server can exploit this vulnerability to read out-of-bounds memory, potentially leading to information disclosure or client instability.

Recommendation

Upgrade FreeRDP to version 3.28.0 or later, which contains the complete fix.

Original NVD description (English source)

FreeRDP is a free implementation of the Remote Desktop Protocol. From 3.21.0 before 3.28.0, FreeRDP clients using the GFX pipeline contain an incomplete fix for CVE-2026-23530 in planar_decompress_plane_rle_only in libfreerdp/codec/planar.c, allowing a malicious RDP server to send a truncated RDPGFX_CMDID_WIRETOSURFACE_1 planar payload that reads one byte past the input buffer. This issue is fixed in version 3.28.0.