CVE-2026-69159

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0

Description In the libfreerdp/codec/planar.c file, the functions planar decompress plane rle() and planar decompress plane rle only() verify the existence of a control byte but fail to confirm if the source buffer contains the raw bytes declared by that byte. A malicious RDP server can send a truncated planar bitmap or surface update where the final control byte claims additional raw bytes, leading the decoder to read beyond the pSrcData variable while processing a color plane. This can result in a client crash or the disclosure of adjacent memory.

Recommendations Update to version 3.29.0.