CVE-2026-57158

CRITICAL

FreeRDP planar_decompress_plane_rle_only: heap OOB read — incomplete fix for CVE-2026-23530

Title source: cna
STIX 2.1

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. From 3.21.0 before 3.28.0, FreeRDP clients using the GFX pipeline contain an incomplete fix for CVE-2026-23530 in planar_decompress_plane_rle_only in libfreerdp/codec/planar.c, allowing a malicious RDP server to send a truncated RDPGFX_CMDID_WIRETOSURFACE_1 planar payload that reads one byte past the input buffer. This issue is fixed in version 3.28.0.

References (4)

Core 4

Scores

CVSS v3 9.1
EPSS 0.0053
EPSS Percentile 41.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Details

CWE
CWE-125
Status published
Products (2)
freerdp/freerdp 3.21.0 - 3.28.0
FreeRDP/FreeRDP >= 3.21.0, < 3.28.0
Published Jul 10, 2026
Tracked Since Jul 11, 2026