CVE-2026-67306 FreeRDP before 3.29.0 Out-of-Bounds Read via Planar RLE

Medium 5.3 Published 1 Aug 2026 Updated 3 Aug 2026

A malicious RDP server can trigger an out-of-bounds read in FreeRDP clients, potentially causing crashes or leaking memory contents.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-67306?

CVE-2026-67306 is a medium-severity memory corruption vulnerability in Freerdp Freerdp, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planar_decompress_plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15 attacker-declared raw bytes are read without validating that the source buffer contains them. A malicious or compromised RDP server can send a truncated planar-encoded bitmap or surface update (reachable via both the Bitmap Update PDU and RDPGFX Surface Command paths) that causes the client to read past the end of the source buffer. The issue is fixed in FreeRDP 3.29.0.

Weakness: CWE-125

Which versions are affected by CVE-2026-67306?

It affects 1 product.

Products include Freerdp Freerdp.

How do I fix CVE-2026-67306?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-67306 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67306 exists.

All Freerdp Freerdp vulnerabilities

Sources

Also known as CVE-2026-69159, DEBIAN-CVE-2026-67306, GHSA-3j62-96cj-jq88, UBUNTU-CVE-2026-67306.