CVE-2026-67306

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0

Description An out-of-bounds read exists in the RDP6 planar RLE bitmap decoder functions planar decompress plane rle() and planar decompress plane rle only() within libfreerdp/codec/planar.c. The system only performs a bounds check on the 1-byte control byte, failing to validate if the source buffer contains the subsequent 0–15 attacker-declared raw bytes. A compromised or malicious RDP server can trigger this by sending a truncated planar-encoded bitmap or surface update through the Bitmap Update PDU or RDPGFX Surface Command paths, forcing the client to read beyond the source buffer's end.

Recommendations Update to version 3.29.0.