ZeroDay Findings
Sign inSign up

Findings

CVE-2026-26965

FreeRDP is a free implementation of the Remote Desktop Protocol.

Published Feb 25, 2026 · updated Jul 15, 2026 · freerdp freerdp

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, writes into at without verifying that fits in the destination height or that fits in the destination stride. When , becomes (sized for the desktop), while is only validated against the **surface** by . A malicious RDP server can exploit this to perform a heap out-of-bounds write with attacker-controlled offset and pixel data on any connecting FreeRDP client. The OOB write reaches up to 132,096 bytes past the temp buffer end, and on the brk heap (desktop ≤ 128×128), an adjacent struct's function pointer is overwritten with attacker-controlled pixel data — control-flow–relevant corruption (function pointer overwritten) demonstrated under deterministic heap layout ( ). Version 3.23.0 fixes the vulnerability.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 25, 2026 · NIST NVD

    Detected

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, writes into at without verifying that fits in the destination height or that fits in the destination stride. When , becomes (sized for the desktop), while is only validated against the **surface** by . A malicious RDP server can exploit this to perform a heap out-of-bounds write

  2. Jul 15, 2026 · NIST NVD

    Updated

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, writes into at without verifying that fits in the destination height or that fits in the destination stride. When , becomes (sized for the desktop), while is only validated against the **surface** by . A malicious RDP server can exploit this to perform a heap out-of-bounds write

Affected

  • cpe freerdp/freerdpversion unspecified

Sources

  • NIST NVDVulnerability recordCVE-2026-26965

    FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, writes into at without verifying that fits in t

    nvd.nist.gov

References