Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.29.0, planar_decompress_plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c verify that a control byte exists but do not verify that the source buffer contains the zero to fifteen raw bytes declared by that control byte. A malicious RDP server can send a truncated planar bitmap or surface update whose final control byte claims additional raw bytes, causing the decoder to read beyond pSrcData while processing a color plane. This can crash the client and may disclose adjacent memory. This issue is fixed in version 3.29.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-19T18:17:19.813Z",
  "pubdate": "2026-08-19T18:17:19.813Z",
  "executiveSummary": "An out-of-bounds read vulnerability exists in FreeRDP prior to version 3.29.0 within the planar bitmap and surface update decompression routines. The vulnerability arises because the decoder functions planar_decompress_plane_rle and planar_decompress_plane_rle_only verify the existence of a control byte but fail to validate that the corresponding source buffer contains the complete set of raw bytes demanded by that control byte.\nA malicious RDP server can exploit this flaw by transmitting a truncated planar bitmap or surface update stream where the final control byte declares up to fifteen raw bytes that exceed the actual remaining length of the source buffer. When processed, the decoder attempts to read beyond the boundaries of pSrcData during color plane reconstruction.\nThe primary impacts of successful exploitation include application crashes resulting in a denial of service, as well as potential adjacent memory disclosure if sensitive data is leaked back through application behavior or error handling. Exploitation requires a compromised or malicious RDP server capable of interacting with a connecting FreeRDP client.",
  "technicalDetails": "The vulnerable component resides in the FreeRDP codebase, specifically within libfreerdp/codec/planar.c. The affected functions are planar_decompress_plane_rle and planar_decompress_plane_rle_only, which are responsible for decoding RDP planar surface updates and bitmaps using run-length encoding (RLE).\nThe root cause of the vulnerability is an insufficient bounds-checking mechanism. During the RLE decompression process, the decoder reads a control byte from the input stream pSrcData. This control byte dictates whether subsequent data consists of runs or specifies a count of zero to fifteen raw bytes to be copied directly into the destination buffer.\nWhile the implementation verifies that the initial control byte itself is present within the buffer boundaries, it omits the necessary validation step to ensure that the source buffer (pSrcData) contains sufficient remaining bytes to satisfy the raw byte count declared by that control byte.\nThe attack flow proceeds as follows: 1. A client initiates or accepts an RDP connection with a malicious RDP server. 2. The malicious server sends a crafted RDP planar bitmap update or surface update containing a deliberately truncated payload. 3. The decoder parses the final control byte, which claims a specific number of subsequent raw bytes that extend past the end of the allocated source memory region. 4. The decoder attempts to read the declared raw bytes from pSrcData, causing the execution flow to read out-of-bounds memory. 5. This triggers an immediate application crash due to an invalid memory access violation, or potentially leaks adjacent heap memory contents depending on how the decoded data is subsequently handled.\nThe vulnerability affects FreeRDP versions prior to 3.29.0. Exploitation requires network exposure via the RDP protocol, where a client connects to an untrusted or compromised server. No authentication or elevated privileges are required by the client, as the malicious behavior originates from the server-to-client data stream."
}