Skip to content
OpenAdvisories
High · 8.8 CVE-2026-26965 EUVD-2026-8740

FreeRDP has Out-of-bounds Write

Published Feb 25, 2026 · Updated Jul 15, 2026 · Assigned by GitHub_M

Vendor: FreeRDP Product: FreeRDP Package: freerdp Package: freerdp Package: freerdp2 Package: freerdp2 Package: freerdp3 Package: freerdp3 Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, `planar_decompress_plane_rle()` writes into `pDstData` at `((nYDst+y) * nDstStep) + (4*nXDst) + nChannel` without verifying that `(nYDst+nSrcHeight)` fits in the destination height or that `(nXDst+nSrcWidth)` fits in the destination stride. When `TempFormat != DstFormat`, `pDstData` becomes `planar->pTempData` (sized for the desktop), while `nYDst` is only validated against the **surface** by `is_within_surface()`. A malicious RDP server can exploit this to perform a heap out-of-bounds write with attacker-controlled offset and pixel data on any connecting FreeRDP client. The OOB write reaches up to 132,096 bytes past the temp buffer end, and on the brk heap (desktop ≤ 128×128), an adjacent `NSC_CONTEXT` struct's `decode` function pointer is overwritten with attacker-controlled pixel data — control-flow–relevant corruption (function pointer overwritten) demonstrated under deterministic heap layout (`nsc->decode = 0xFF414141FF414141`). Version 3.23.0 fixes the vulnerability.

Affected products

VendorProductAffectedFixed
FreeRDP FreeRDP < 3.23.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 freerdp3 3.23.0+dfsg-1 —
Debian 13 freerdp3 3.15.0+dfsg-2.1+deb13u1 —
Debian 12 freerdp2 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 freerdp3 3.16.0+dfsg-2ubuntu0.3 USN-8105-1
Ubuntu 24.04 LTS freerdp3 3.5.1+dfsg1-0ubuntu1.4 USN-8105-1
Ubuntu 22.04 LTS freerdp2 No fix yet —
Ubuntu 18.04 LTS freerdp No fix yet —
Ubuntu 16.04 LTS freerdp No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS freerdp2 No fix yet —
Ubuntu Pro 20.04 LTS freerdp2 No fix yet —
Ubuntu Pro 18.04 LTS freerdp2 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 freerdp +5 2:3.10.3-5.el10_1.3 RHSA-2026:19033, RHSA-2026:5939
RHEL 9 freerdp +4 2:2.11.7-1.el9_7.3 RHSA-2026:6004
RHEL 8 freerdp +4 2:2.11.7-4.el8_10 RHSA-2026:6005
Show 14 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS freerdp +5 2:3.10.3-3.el10_0.3 RHSA-2026:5936
RHEL 9.6 EUS freerdp +4 2:2.11.7-1.el9_6.5 RHSA-2026:6385
RHEL 9.4 EUS freerdp +4 2:2.11.2-1.el9_4.3 RHSA-2026:6384
RHEL 9.2 E4S freerdp +2 2:2.4.1-6.el9_2.4 RHSA-2026:6396
RHEL 9.0 E4S freerdp +2 2:2.4.1-3.el9_0.2 RHSA-2026:6395
RHEL 8.8 TUS freerdp +3 2:2.2.0-12.el8_8.3 RHSA-2026:6764
RHEL 8.8 E4S freerdp +3 2:2.2.0-12.el8_8.3 RHSA-2026:6764
RHEL 8.6 TUS freerdp +3 2:2.2.0-7.el8_6.3 RHSA-2026:6665
RHEL 8.6 E4S freerdp +3 2:2.2.0-7.el8_6.3 RHSA-2026:6665
RHEL 8.6 AUS freerdp +3 2:2.2.0-7.el8_6.3 RHSA-2026:6665
RHEL 8.4 EUS Long Life freerdp +3 2:2.2.0-10.el8_4 RHSA-2026:6616
RHEL 8.4 AUS freerdp +3 2:2.2.0-10.el8_4 RHSA-2026:6616
RHEL 8.2 AUS freerdp +3 2:2.0.0-46.rc4.el8_2.8 RHSA-2026:6712
RHEL 7 ELS freerdp +4 2.1.1-5.el7_9.5 RHSA-2026:7292

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 freerdp +5 2:3.10.3-5.el10_1.3 ALSA-2026:5939
AlmaLinux 9 freerdp +4 2:2.11.7-1.el9_7.3 ALSA-2026:6004
AlmaLinux 8 freerdp +4 2:2.11.7-4.el8_10 ALSA-2026:6005

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 freerdp 2:2.11.7-4.el8_10 RLSA-2026:6005

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 freerdp 2.4.0-150400.3.47.1 SUSE-SU-2026:1398-1, SUSE-SU-2026:1160-1, SUSE-SU-2026:1129-1
SLES 15 SP7 freerdp2 2.11.7-150700.3.14.1 SUSE-SU-2026:1164-1
SLES 12 SP5 freerdp 2.1.2-12.63.1 SUSE-SU-2026:1165-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed freerdp 3.24.1-1.1 openSUSE-SU-2026:10408-1
openSUSE Tumbleweed freerdp2 2.11.7-6.1 openSUSE-SU-2026:10459-1
openSUSE Leap 15.6 freerdp 2.11.2-150600.4.18.1 SUSE-SU-2026:1160-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 freerdp 3.23.0-r0 —
Alpine v3.23 freerdp 3.23.0-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 freerdp +5 2:3.6.3-1.amzn2023.0.5 ALAS2023-2026-1485
Amazon Linux 2 freerdp +4 2:2.11.7-1.amzn2.0.6 ALAS2-2026-3199

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 freerdp +5 2:3.10.3-5.el10_1.3 ELSA-2026-19033, ELSA-2026-5939
Oracle Linux 9 freerdp +4 2:2.11.7-1.el9_7.3 ELSA-2026-6004
Oracle Linux 8 freerdp +4 2:2.11.7-4.el8_10 ELSA-2026-6005
Oracle Linux 7 freerdp +4 2.1.1-5.0.5.el7_9 ELSA-2026-7292

Advisories 34

References