CVE-2026-45700
Critical · CVSS 9.8FreeRDP — Out-of-bounds heap write (OOB write) in planar bitmap RLE decoder
- CVSS
- 9.8
- nvd
- EPSS
- 0.63%
- 47th pct
- KEV
- No
- Class
- oss containerizable
- CWE-787, CWE-787
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's planar bitmap decoder has an out-of-bounds heap write when decoding RLE planar data. In libfreerdp/codec/planar.c, freerdp_bitmap_decompress_planar() validates the X destination coordinate nXDst against the caller-provided destination stride (nDstStep) even when it is writing into the internal temp buffer pTempData. An attacker can bypass the check with a large nDstStep and a large nXDst, causing planar_decompress_plane_rle() to write past the end of pTempData. This vulnerability is fixed in 3.26.0.
Search profile — drives PoC discovery
Ranked PoCs (1) — best first
Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.
- ★ 0
Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.
References
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mpxh-8fq3-x8mh
- https://access.redhat.com/errata/RHSA-2026:36203
- https://access.redhat.com/errata/RHSA-2026:37207
- https://access.redhat.com/errata/RHSA-2026:38501
- https://access.redhat.com/errata/RHSA-2026:46383
- https://access.redhat.com/errata/RHSA-2026:46384
- https://access.redhat.com/errata/RHSA-2026:46388
- https://access.redhat.com/errata/RHSA-2026:46389
- https://access.redhat.com/errata/RHSA-2026:46393
- https://access.redhat.com/errata/RHSA-2026:47048
- https://access.redhat.com/errata/RHSA-2026:47049
- https://access.redhat.com/errata/RHSA-2026:47201
Status: enriched · ingested 2026-06-30T06:00:22.000Z · profiled 2026-07-01T12:30:14.000Z