by Kastro
Paper/Archive/CVE-2026-57158

CVE-2026-57158

FreeRDP FreeRDP — FreeRDP planar_decompress_plane_rle_only: heap OOB read — incomplete fix for CVE-2026-23530

EPSS 0.7%public exploitCVSS 9.1
critical.is priorityof 100
48
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 52.8.528 × 2010.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

FreeRDP is a free implementation of the Remote Desktop Protocol. From 3.21.0 before 3.28.0, FreeRDP clients using the GFX pipeline contain an incomplete fix for CVE-2026-23530 in planar_decompress_plane_rle_only in libfreerdp/codec/planar.c, allowing a malicious RDP server to send a truncated RDPGFX_CMDID_WIRETOSURFACE_1 planar payload that reads one byte past the input buffer. This issue is fixed in version 3.28.0.

Affected

ProductAffectedFixed inSource
FreeRDP>= 3.21.0, < 3.28.0–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
GitHub_M (CNA)5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

exploitgithub.com/FreeRDP/FreeRDP/security/advisories/GHSA-mp3f-59pg-c5pprefgithub.com/FreeRDP/FreeRDP/pull/12952refgithub.com/FreeRDP/FreeRDP/commit/a7e797626fcb7f1d556ce63febb84f9f4a822731refgithub.com/FreeRDP/FreeRDP/releases/tag/3.28.0