CVE-2026-69159
Received Received - Intake

Remote Code Execution in FreeRDP

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.29.0, planar_decompress_plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c verify that a control byte exists but do not verify that the source buffer contains the zero to fifteen raw bytes declared by that control byte. A malicious RDP server can send a truncated planar bitmap or surface update whose final control byte claims additional raw bytes, causing the decoder to read beyond pSrcData while processing a color plane. This can crash the client and may disclose adjacent memory. This issue is fixed in version 3.29.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-69159
EUVD
EUVD-2026-62673

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
freerdp freerdp to 3.29.0 (exc)
freerdp freerdp 3.29.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-69159 is an out-of-bounds read vulnerability in FreeRDP's Planar RLE decoder. The functions planar_decompress_plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c do not verify that the source buffer contains enough bytes for the claimed run length after checking a control byte. A malicious RDP server can send a truncated bitmap causing the decoder to read beyond the buffer, leading to crashes or memory disclosure.

Detection Guidance

Detecting this vulnerability requires monitoring FreeRDP versions and network traffic for RDP connections. Check your FreeRDP version with 'xfreerdp --version' or 'apt list --installed | grep freerdp'. Inspect RDP server responses for malformed planar-encoded bitmaps using network tools like Wireshark with RDP protocol filters. Enable AddressSanitizer or similar tools during FreeRDP compilation to catch out-of-bounds reads.

Impact Analysis

This vulnerability can crash the FreeRDP client when processing a malicious RDP server's bitmap or surface update. It may also disclose adjacent memory contents. Users connecting to untrusted RDP servers are at risk. Updating to FreeRDP 3.29.0 or later mitigates this issue.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by exposing sensitive data through memory disclosure. An out-of-bounds read may allow unauthorized access to adjacent memory, which could include confidential or protected health information if processed by the client. Organizations using FreeRDP in environments subject to these regulations must ensure systems are updated to version 3.29.0 or later to mitigate this risk.

Mitigation Strategies

Immediately update FreeRDP to version 3.29.0 or later using your package manager (e.g., 'apt upgrade freerdp'). If updating is not possible, restrict RDP connections to trusted servers only and disable planar encoding in client configurations. Monitor for crashes or memory corruption in FreeRDP processes as potential exploitation signs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69159. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart