Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-10T19:49:03 FreeRDP: FreeRDP: Information disclosure via truncated RDPGFX planar payload 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CWE-125

FreeRDP is a free implementation of the Remote Desktop Protocol. From 3.21.0 before 3.28.0, FreeRDP clients using the GFX pipeline contain an incomplete fix for CVE-2026-23530 in planar_decompress_plane_rle_only in libfreerdp/codec/planar.c, allowing a malicious RDP server to send a truncated RDPGFX_CMDID_WIRETOSURFACE_1 planar payload that reads one byte past the input buffer. This issue is fixed in version 3.28.0.

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). FreeRDP clients using the Graphics (GFX) pipeline are vulnerable to an out-of-bounds read. A malicious RDP server can exploit this by sending a specially crafted, truncated RDPGFX_CMDID_WIRETOSURFACE_1 planar payload. This can lead to reading one byte beyond the intended buffer, potentially disclosing sensitive information or causing a denial of service.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Enterprise Linux 10 Fix deferred freerdp Red Hat Enterprise Linux 6 Out of support scope freerdp Red Hat Enterprise Linux 7 Out of support scope freerdp Red Hat Enterprise Linux 8 Fix deferred freerdp Red Hat Enterprise Linux 9 Fix deferred freerdp https://www.cve.org/CVERecord?id=CVE-2026-57158 https://nvd.nist.gov/vuln/detail/CVE-2026-57158 https://github.com/FreeRDP/FreeRDP/commit/a7e797626fcb7f1d556ce63febb84f9f4a822731 https://github.com/FreeRDP/FreeRDP/pull/12952 https://github.com/FreeRDP/FreeRDP/releases/tag/3.28.0 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mp3f-59pg-c5pp