CVE-2026-23530

Impact

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrcHeight` against `planar->maxWidth`/`maxHeight` before RLE decode. A malicious server can trigger a client‑side heap buffer overflow, causing a crash (DoS) and potential heap corruption with code‑execution risk depending on allocator behavior and surrounding heap layout. Version 3.21.0 contains a patch for the issue.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/planar.c#L1689-L1696
• https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/planar.c#L1713-L1716
• https://github.com/FreeRDP/FreeRDP/blob/38514dfa5813aa945a86cfbcec279033f8394468/libfreerdp/codec/planar.c#L951-L953
• https://github.com/FreeRDP/FreeRDP/releases/tag/3.21.0
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r4hv-852m-fq7p
• https://access.redhat.com/errata/RHSA-2026:2048
• https://access.redhat.com/errata/RHSA-2026:2081
• https://access.redhat.com/errata/RHSA-2026:2222
• https://access.redhat.com/errata/RHSA-2026:2714
• https://access.redhat.com/errata/RHSA-2026:2736
• https://access.redhat.com/errata/RHSA-2026:2770
• https://access.redhat.com/errata/RHSA-2026:2824
• https://access.redhat.com/errata/RHSA-2026:2952
• https://access.redhat.com/errata/RHSA-2026:3036
• https://access.redhat.com/errata/RHSA-2026:3037
• https://access.redhat.com/errata/RHSA-2026:3038
• https://access.redhat.com/errata/RHSA-2026:3039
• https://access.redhat.com/errata/RHSA-2026:3041
• https://access.redhat.com/security/cve/CVE-2026-23530
• https://bugzilla.redhat.com/show_bug.cgi?id=2430877
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23530.json