PT-2026-67286 · Freerdp · Freerdp

Hexer365 · CVE-2026-67306 · Published 2026-08-01 · Updated 2026-08-01

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0

Description An out-of-bounds read exists in the RDP6 planar RLE bitmap decoder functions planar decompress plane rle() and planar decompress plane rle only() within libfreerdp/codec/planar.c. The system only performs a bounds check on the 1-byte control byte, failing to validate if the source buffer contains the subsequent 0–15 attacker-declared raw bytes. A compromised or malicious RDP server can trigger this by sending a truncated planar-encoded bitmap or surface update through the Bitmap Update PDU or RDPGFX Surface Command paths, forcing the client to read beyond the source buffer's end.

Recommendations Update to version 3.29.0.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-67306

GHSA-QRXX-7G3C-J6W3

Affected Products

Freerdp

References · 6

• 🔥 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qrxx-7g3c-j6w3 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67306.json · Exploit
• https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-67306 · Security Note
• https://osv.dev/vulnerability/CVE-2026-67306 · Vendor Advisory
• https://vulncheck.com/advisories/freerdp-before-out-of-bounds-read-via-planar-rle · Note