CVE-2026-57158: FreeRDP Buffer Overflow Vulnerability

CVE-2026-57158 Overview

CVE-2026-57158 is an out-of-bounds read vulnerability [CWE-125] in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). The flaw affects FreeRDP clients using the Graphics Pipeline (GFX) and stems from an incomplete fix for CVE-2026-23530 in the planar_decompress_plane_rle_only function within libfreerdp/codec/planar.c. A malicious RDP server can send a truncated RDPGFX_CMDID_WIRETOSURFACE_1 planar payload that causes the client to read one byte past the input buffer. The issue affects versions from 3.21.0 up to but not including 3.28.0.

Critical Impact
A malicious RDP server can trigger a one-byte out-of-bounds read in connected FreeRDP clients, leading to information disclosure or client-side denial of service.

Affected Products

FreeRDP versions 3.21.0 through 3.27.x
FreeRDP clients that enable the GFX pipeline
Applications embedding the affected libfreerdp codec library

Discovery Timeline

2026-07-10 - CVE-2026-57158 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-57158

Vulnerability Analysis

The vulnerability lives in the run-length encoding (RLE) decoder for planar-compressed bitmaps used by the FreeRDP GFX pipeline. The planar_decompress_plane_rle_only function reads a control byte from the source buffer inside a decoding loop. The previous fix for CVE-2026-23530 checked the buffer bounds after advancing the read pointer, allowing a single byte to be dereferenced before the boundary check rejected the payload. When a malicious RDP server sends a truncated RDPGFX_CMDID_WIRETOSURFACE_1 message, the client reads one byte beyond the allocated input buffer during decompression.

Root Cause

The root cause is an off-by-one boundary validation error. The original bounds check evaluated (srcp - pSrcData) > SrcSize only after the increment, missing the read of the current byte. The fix reorders the logic to compute cur + 1 > SrcSize before dereferencing *srcp, ensuring the check covers the byte about to be read.

Attack Vector

Exploitation requires a victim to initiate an RDP session to an attacker-controlled server. This scenario is typical in RDP relay attacks, phishing lures that ship .rdp files, or environments where administrators connect outward to untrusted endpoints. User interaction is required to establish the session. The vulnerability yields a bounded out-of-bounds read rather than remote code execution, but adjacent heap memory contents may be reflected into the rendering pipeline.

// Patch to libfreerdp/codec/planar.c
// Source: https://github.com/FreeRDP/FreeRDP/commit/a7e797626fcb7f1d556ce63febb84f9f4a822731

		for (UINT32 x = 0; x < nWidth;)
		{
-			BYTE controlByte = *srcp;
-			srcp++;
-
-			if ((srcp - pSrcData) > SrcSize * 1ll)
+			const size_t cur = (srcp - pSrcData);
+			if (cur + 1 > SrcSize * 1ll)
			{
				WLog_ERR(TAG, "error reading input buffer");
				return -1;
			}

+			BYTE controlByte = *srcp;
+			srcp++;

			UINT32 nRunLength = PLANAR_CONTROL_BYTE_RUN_LENGTH(controlByte);
			UINT32 cRawBytes = PLANAR_CONTROL_BYTE_RAW_BYTES(controlByte);

The patch moves the bounds check ahead of the byte read, validating that at least one byte remains before dereferencing the source pointer. See the FreeRDP Security Advisory GHSA-mp3f-59pg-c5pp for full technical details.

Detection Methods for CVE-2026-57158

Indicators of Compromise

FreeRDP client log entries containing error reading input buffer originating from the planar decoder
Unexpected client crashes or termination during RDP sessions with untrusted servers
Outbound RDP (TCP/3389) sessions to unknown or newly-registered destination hosts

Detection Strategies

Inventory endpoints and applications that bundle libfreerdp and identify versions between 3.21.0 and 3.27.x
Monitor process telemetry for FreeRDP-based clients (xfreerdp, wlfreerdp, embedded viewers) crashing during GFX pipeline decoding
Correlate outbound RDP connections with process image and command-line metadata to identify untrusted destinations

Monitoring Recommendations

Enable verbose FreeRDP logging (WLOG_LEVEL=WARN or higher) to capture planar decoder errors
Alert on outbound RDP flows crossing network boundaries to non-corporate IP ranges
Track software bill of materials (SBOM) entries for FreeRDP across managed applications

How to Mitigate CVE-2026-57158

Immediate Actions Required

Upgrade FreeRDP to version 3.28.0 or later on all affected clients and embedded applications
Restrict outbound RDP connections from user workstations to approved corporate destinations only
Audit third-party software that bundles libfreerdp and coordinate updates with vendors

Patch Information

The issue is fixed in FreeRDP 3.28.0. The upstream fix is available in commit a7e797626fcb7f1d556ce63febb84f9f4a822731 and was merged via pull request #12952. Release artifacts are available on the FreeRDP 3.28.0 release page.

Workarounds

Disable the GFX pipeline in client connection profiles when connecting to untrusted servers
Limit RDP client usage to sessions with vetted, corporate-managed servers
Apply network egress policies that block RDP to non-approved destinations until patching completes

bash

# Verify installed FreeRDP version and upgrade
xfreerdp --version

# Debian/Ubuntu example - update once distribution package reaches 3.28.0
sudo apt-get update && sudo apt-get install --only-upgrade freerdp2-x11 freerdp3-x11

# Connect with GFX pipeline disabled as a temporary workaround
xfreerdp /v:server.example.com -gfx /gdi:sw