CVE-2026-67306: FreeRDP Buffer Overflow Vulnerability

CVE-2026-67306 Overview

CVE-2026-67306 is an out-of-bounds read vulnerability in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). The flaw resides in the RDP6 planar Run-Length Encoding (RLE) bitmap decoder functions planar_decompress_plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15 attacker-declared raw bytes are read without validating the source buffer size. A malicious or compromised RDP server can trigger the read by sending a truncated planar-encoded bitmap or surface update. The issue is fixed in FreeRDP 3.29.0.

Critical Impact
A malicious RDP server can force a connected FreeRDP client to read past the end of a source buffer, leading to information disclosure or client-side crash conditions.

Affected Products

FreeRDP versions 3.28.0 and earlier
FreeRDP client applications linking libfreerdp/codec/planar.c
Downstream projects embedding vulnerable FreeRDP builds

Discovery Timeline

2026-08-01 - CVE-2026-67306 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67306

Vulnerability Analysis

The vulnerability affects the RDP6 planar RLE decompression path used by FreeRDP clients to parse bitmap and surface updates from a server. The decoder reads a 1-byte control byte that encodes both the run type and the run length. It then reads 0 to 15 raw bytes from the source buffer based on values declared in the control byte. The bounds check validates only the control byte itself and does not verify that the declared raw byte count fits within the remaining source buffer. This is classified as [CWE-125] Out-of-Bounds Read.

Root Cause

The root cause is missing input validation in planar_decompress_plane_rle and planar_decompress_plane_rle_only. Both functions trust the attacker-controlled length fields inside the planar stream without cross-checking against the actual source buffer boundary. When the server sends a truncated stream, the decoder walks beyond the allocated buffer while copying raw pixel bytes.

Attack Vector

A malicious or compromised RDP server delivers a crafted planar-encoded bitmap or surface update to a connecting FreeRDP client. Two protocol paths reach the vulnerable code: the Bitmap Update Protocol Data Unit (PDU) and the RDPGFX Surface Command path. Exploitation requires the user to initiate a session against the attacker-controlled server. Successful triggering can leak adjacent process memory or crash the client.

text

// Patch reference from FreeRDP release-3.28.0 tag
 function(get_project_version VERSION_MAJOR VERSION_MINOR VERSION_REVISION VERSION_SUFFIX GIT_REVISION)
 
   # Default version, hard codec per release
-  set(RAW_VERSION_STRING "3.27.2-dev0")
+  set(RAW_VERSION_STRING "3.28.0")
 
   set(VERSION_REGEX "^(.*)([0-9]+)\\.([0-9]+)\\.([0-9]+)-?(.*)")

Source: FreeRDP commit 5370fb26fbf034ecd11d3026b6ad639b5fff493f

Detection Methods for CVE-2026-67306

Indicators of Compromise

FreeRDP client processes crashing or terminating unexpectedly during RDP session establishment or mid-session updates.
Outbound RDP (TCP/3389) connections from client hosts to untrusted or newly observed servers.
Anomalous planar-encoded bitmap or RDPGFX Surface Command payloads captured in network traces.

Detection Strategies

Inventory installed FreeRDP versions across the fleet and flag any build below 3.29.0.
Inspect RDP traffic for malformed Bitmap Update PDUs whose declared planar RLE length exceeds the remaining payload.
Correlate client-side process crashes with recent outbound RDP session events to identify targeted probing.

Monitoring Recommendations

Log outbound RDP connections initiated by FreeRDP-based clients such as xfreerdp and wlfreerdp.
Alert on FreeRDP client crashes observed via endpoint telemetry and core dumps.
Track deployments of third-party software that statically links FreeRDP libraries.

How to Mitigate CVE-2026-67306

Immediate Actions Required

Upgrade FreeRDP to version 3.29.0 or later on all client hosts.
Update downstream applications that bundle FreeRDP with patched builds sourced from the vendor.
Restrict outbound RDP connectivity to a vetted allowlist of trusted server endpoints.

Patch Information

The fix landed in FreeRDP 3.29.0. Review the upstream fix in the FreeRDP GitHub commit and the GitHub Security Advisory GHSA-qrxx-7g3c-j6w3. Additional context is available in the VulnCheck advisory.

Workarounds

Avoid connecting FreeRDP clients to untrusted or unverified RDP servers until patched builds are deployed.
Enforce egress filtering to block RDP connections to arbitrary internet destinations.
Use jump hosts or bastion proxies that terminate RDP with hardened, patched implementations.

bash

# Verify installed FreeRDP client version and upgrade if below 3.29.0
xfreerdp --version
# Example: rebuild from source at the fixed tag
git clone https://github.com/FreeRDP/FreeRDP.git
cd FreeRDP
git checkout 3.29.0
cmake -B build -S . && cmake --build build