← Vulnerability feed

Vulnerability record · CVE-2026-45700 · published 29 May 2026

CVE-2026-45700: Freerdp out-of-bounds write vulnerability

Freerdp · Freerdp

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's planar bitmap decoder has an out-of-bounds heap write when decoding RLE planar data. In libfreerdp/codec/planar.c, freerdp_bitmap_decompress_planar() validates the X destination coordinate nXDst against the caller-provided destination stride (nDstStep) even when it is writing into the internal temp buffer pTempData. An attacker can bypass the check with a large nDstStep and a large nXDst, causing planar_decompress_plane_rle() to write past the end of pTempData. This vulnerability is fixed in 3.26.0.

7.7 CVSS 4.0 High EPSS 0.78% · top 45.9% CWE-787 · Out-of-bounds write
7.7CVSS 4.0 base score
0.78%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
16References, 2 tagged exploit
29 Jul 2026Last modified by NVD

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's planar bitmap decoder has an out-of-bounds heap write when decoding RLE planar data. In libfreerdp/codec/planar.c, freerdp_bitmap_decompress_planar() validates the X destination coordinate nXDst against the caller-provided destination stride (nDstStep) even when it is writing into the internal temp buffer pTempData. An attacker can bypass the check with a large nDstStep and a large nXDst, causing planar_decompress_plane_rle() to write past the end of pTempData. This vulnerability is fixed in 3.26.0.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mpxh-8fq3-x8mh ExploitMitigationVendor Advisory
https://access.redhat.com/errata/RHSA-2026:36203
https://access.redhat.com/errata/RHSA-2026:37207
https://access.redhat.com/errata/RHSA-2026:38501
https://access.redhat.com/errata/RHSA-2026:46383
https://access.redhat.com/errata/RHSA-2026:46384
https://access.redhat.com/errata/RHSA-2026:46388
https://access.redhat.com/errata/RHSA-2026:46389
https://access.redhat.com/errata/RHSA-2026:46393
https://access.redhat.com/errata/RHSA-2026:47048
https://access.redhat.com/errata/RHSA-2026:47049
https://access.redhat.com/errata/RHSA-2026:47201
https://access.redhat.com/security/cve/CVE-2026-45700
https://bugzilla.redhat.com/show_bug.cgi?id=2483470
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mpxh-8fq3-x8mh ExploitMitigationVendor Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45700.json

Track CVE-2026-45700 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-31883Freerdp heap-based buffer overflow vulnerabilityFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders lea…EPSS 0.32%9.8CVE-2024-32662Freerdp out-of-bounds read vulnerabilityFreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. T…EPSS 0.77%9.8CVE-2024-32659Freerdp out-of-bounds read vulnerabilityFreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read if…EPSS 1.2%9.8CVE-2024-32658Freerdp out-of-bounds read vulnerabilityFreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. V…EPSS 1.4%9.8CVE-2024-32459Freerdp out-of-bounds read vulnerabilityFreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to 3.5.0 or 2.…EPSS 3.7%9.8CVE-2024-32460Freerdp out-of-bounds read vulnerabilityFreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using `/bpp:32` legacy `GDI` drawing path with a version…EPSS 1.9%9.8CVE-2024-32039Freerdp integer overflow vulnerabilityFreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulner…EPSS 2.3%9.8CVE-2024-32040Freerdp vulnerabilityFreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and hav…EPSS 1.9%

Source: NIST National Vulnerability Database (record CVE-2026-45700), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.