CVE-2026-69159: FreeRDP Buffer Overflow Vulnerability

CVE-2026-69159 Overview

CVE-2026-69159 is an out-of-bounds read vulnerability [CWE-125] in FreeRDP, a widely deployed open-source implementation of the Remote Desktop Protocol (RDP). The flaw resides in the planar_decompress_plane_rle and planar_decompress_plane_rle_only functions in libfreerdp/codec/planar.c. These functions validate the presence of a control byte but fail to confirm that the source buffer contains the declared raw bytes. A malicious RDP server can deliver a truncated planar bitmap or surface update, forcing the client decoder to read past pSrcData. The condition can crash the FreeRDP client and may disclose adjacent process memory. The issue is fixed in FreeRDP version 3.29.0.

Critical Impact
A malicious RDP server can crash connected FreeRDP clients and potentially leak adjacent memory contents when a user initiates an RDP session.

Affected Products

FreeRDP versions prior to 3.29.0
FreeRDP-based RDP client applications and libraries
Downstream distributions bundling vulnerable FreeRDP builds

Discovery Timeline

2026-08-19 - CVE-2026-69159 published to NVD
2026-08-19 - Last updated in NVD database
FreeRDP 3.29.0 - Fix released via commit 75a1ec6 and pull request #13016

Technical Details for CVE-2026-69159

Vulnerability Analysis

The FreeRDP planar codec decodes RLE-compressed color planes used in bitmap and surface updates. Each RLE segment begins with a control byte that encodes a run length and an optional count of raw pixel bytes (zero to fifteen) that immediately follow. The vulnerable functions in libfreerdp/codec/planar.c confirm that the control byte itself is readable but do not check that the declared raw bytes remain within the source buffer.

When a server supplies a truncated segment where the final control byte claims raw bytes that extend past the end of pSrcData, the decoder reads beyond the allocated buffer. Depending on heap layout, the read can trigger a crash or copy adjacent memory into the reconstructed plane. Because the plane data is later rendered or returned to the client, leaked bytes may become observable to the attacker-controlled server.

Root Cause

The root cause is missing bounds validation between a length field parsed from untrusted input and the remaining size of the source buffer. The prior implementation trusted the control byte to describe a segment that fits within SrcSize. Any RDP server that speaks the planar codec can violate that assumption.

Attack Vector

Exploitation requires a user to connect a FreeRDP client to a malicious or compromised RDP server. Once the session negotiates the planar codec, the server sends a crafted bitmap or surface update containing a truncated color plane. No authentication of the server beyond the user's own connection choice is required.

// Patch: adds an explicit source-buffer bounds check
// Source: https://github.com/FreeRDP/FreeRDP/commit/75a1ec61d444179ea64a4ec0835214cb9c4f7c18
static inline bool check_source_available(const BYTE* buffer, size_t length, const BYTE* cur,
                                          size_t required)
{
    WINPR_ASSERT(cur >= buffer);
    const size_t len = WINPR_ASSERTING_INT_CAST(size_t, (cur - buffer));

    if ((SIZE_MAX - len < required) || (len + required > length))
    {
        WLog_ERR(TAG, "error reading input buffer");
        return false;
    }
    return true;
}

The helper is invoked before every raw-byte read in planar_decompress_plane_rle and planar_decompress_plane_rle_only, ensuring the decoder aborts on truncated input rather than reading past pSrcData.

Detection Methods for CVE-2026-69159

Indicators of Compromise

FreeRDP client processes (freerdp, xfreerdp, wlfreerdp) crashing shortly after connecting to a remote host
Log entries containing error reading input buffer from the FreeRDP TAG logger after applying the patch
Outbound RDP sessions to untrusted or newly observed servers preceding client crashes

Detection Strategies

Inventory endpoints running FreeRDP builds older than 3.29.0, including third-party applications that embed the library
Correlate FreeRDP process crashes with concurrent outbound TCP/3389 connections in endpoint telemetry
Inspect RDP session metadata for connections to servers outside sanctioned management ranges

Monitoring Recommendations

Alert on repeated FreeRDP client termination events on the same host within short intervals
Monitor for RDP connections initiated to internet-facing or previously unseen RDP servers
Capture and review FreeRDP debug logs when the client is used to reach untrusted infrastructure

How to Mitigate CVE-2026-69159

Immediate Actions Required

Upgrade all FreeRDP installations to version 3.29.0 or later
Rebuild and redistribute downstream applications that statically link older FreeRDP versions
Restrict outbound RDP connections from FreeRDP clients to trusted management networks only

Patch Information

The fix is included in FreeRDP 3.29.0, delivered by commit 75a1ec61d444179ea64a4ec0835214cb9c4f7c18 and pull request #13016. The patch introduces the check_source_available helper and applies it to all raw-byte reads within the planar RLE decoders. Refer to the FreeRDP Security Advisory GHSA-qrxx-7g3c-j6w3 and the FreeRDP 3.29.0 release notes for full details.

Workarounds

Avoid connecting FreeRDP clients to untrusted or attacker-controlled RDP servers until patched
Disable the planar codec in client configuration where operationally acceptable
Enforce network egress policies that limit RDP destinations to known, trusted hosts

bash

# Verify installed FreeRDP version and upgrade
xfreerdp --version

# Debian/Ubuntu example
sudo apt-get update && sudo apt-get install --only-upgrade freerdp2-x11 freerdp3-x11

# Build from source at the fixed tag
git clone https://github.com/FreeRDP/FreeRDP.git
cd FreeRDP && git checkout 3.29.0
cmake -B build -S . && cmake --build build