CVE-2026-23530
Published: 19 January 2026
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrcHeight` against `planar->maxWidth`/`maxHeight` before RLE decode. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap…
more
corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates identification, reporting, and timely patching of flaws like the heap buffer overflow in FreeRDP's freerdp_bitmap_decompress_planar, as fixed in version 3.21.0.
Requires validation of information inputs such as nSrcWidth and nSrcHeight against maxWidth and maxHeight prior to RLE decompression to prevent the buffer overflow.
Implements memory safeguards like non-executable heap regions and randomization to mitigate code execution risks from heap corruption caused by the unvalidated bitmap decompression.
Security SummaryAI
CVE-2026-23530 is a heap buffer overflow vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol, affecting versions prior to 3.21.0. The flaw occurs in the `freerdp_bitmap_decompress_planar` function, which does not validate the `nSrcWidth` and `nSrcHeight` parameters against `planar->maxWidth` and `maxHeight` before performing RLE decompression. Classified as CWE-122, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A remote attacker controlling a malicious RDP server can exploit this issue against a connecting FreeRDP client by sending crafted bitmap data. No user privileges or interaction are required, enabling low-complexity network-based attacks that trigger a client-side heap buffer overflow. This results in application crashes for denial of service, with potential heap corruption that could lead to code execution depending on the memory allocator and surrounding heap layout.
FreeRDP version 3.21.0 includes a patch resolving the vulnerability. Mitigation involves updating to this version or later, as detailed in the project's release notes and security advisory (GHSA-r4hv-852m-fq7p). Code changes addressing the validation are visible in the affected planar.c source files.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in FreeRDP client exploitable by malicious RDP server via crafted bitmap data enables remote code execution through client application vulnerability.