Remote Code Execution in FreeRDP Client

Executive Summary

CVE-2026-57158 is a heap out-of-bounds read vulnerability in FreeRDP, specifically in the planar_decompress_plane_rle_only function within the libfreerdp/codec/planar.c file.

The vulnerability occurs because the function reads one byte past the end of the input buffer without properly validating the buffer boundaries. This happens when a malicious RDP server sends a truncated RDPGFX_CMDID_WIRETOSURFACE_1 planar payload.

This issue is an incomplete fix of a previous vulnerability (CVE-2026-23530) and affects FreeRDP clients using the GFX pipeline from versions 3.21.0 up to before 3.28.0.

The vulnerability allows reading memory beyond the intended buffer, classified as CWE-125 (Out-of-bounds Read).

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a malicious RDP server to cause the FreeRDP client to read one byte beyond the allocated input buffer.

While the severity is rated as low, such out-of-bounds reads can potentially lead to information disclosure or cause the client to behave unexpectedly.

Exploitation requires no user interaction beyond connecting to a malicious RDP server, making it a risk for users who connect to untrusted or compromised servers.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs when a FreeRDP client using the GFX pipeline connects to a malicious RDP server that sends a truncated RDPGFX_CMDID_WIRETOSURFACE_1 planar payload causing a 1-byte out-of-bounds read. Detection involves monitoring FreeRDP client connections for abnormal or malformed RDPGFX_CMDID_WIRETOSURFACE_1 packets or crashes related to the planar codec.

Since the vulnerability is triggered by a specific malformed packet from the server, network detection could involve capturing and analyzing RDP traffic with tools like Wireshark or tcpdump to identify truncated or malformed RDPGFX_CMDID_WIRETOSURFACE_1 packets.

• Use tcpdump to capture RDP traffic: tcpdump -i <interface> port 3389 -w rdp_traffic.pcap
• Analyze the capture with Wireshark, filtering for RDPGFX packets and inspecting for truncated or malformed planar payloads.

On the system side, monitoring FreeRDP client logs for errors or crashes related to the planar codec function planar_decompress_plane_rle_only may help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in FreeRDP version 3.28.0 by implementing a proper range check and early abort in the planar_decompress_plane_rle_only function to prevent out-of-bounds reads.

Immediate mitigation steps include:

• Upgrade FreeRDP clients to version 3.28.0 or later where the vulnerability is fixed.
• If upgrading is not immediately possible, avoid connecting FreeRDP clients to untrusted or potentially malicious RDP servers.
• Monitor FreeRDP client logs for any unusual errors or crashes that might indicate exploitation attempts.

Useful 0 Not Useful 0

Compliance Impact

The provided context and resources do not contain information regarding the impact of CVE-2026-57158 on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0