Out-of-bounds write in FreeRDP - CVE-2026-45700
Published: May 12, 2026 / Updated: June 16, 2026
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.
The vulnerability exists due to out-of-bounds write in freerdp_bitmap_decompress_planar() and planar_decompress_plane_rle() in the planar bitmap decoder when decoding RLE planar data with a large destination stride and X destination coordinate that trigger the temp-buffer code path. A remote attacker can send specially crafted planar bitmap data to cause a denial of service and potentially execute arbitrary code.
No FreeRDP server or client is affected; the issue affects third-party implementations that use their own decoding system and utilize the FreeRDP planar decoder.
Affected software
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux Server - AUS
Ubuntu
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
freerdp2 (Ubuntu package)
freerdp (Red Hat package)
freerdp
freerdp-devel
freerdp-libs
libwinpr
libwinpr-devel
freerdp-doc
How to mitigate CVE-2026-45700
freerdp2 (Ubuntu package) - addressed in versions 2.2.0+dfsg1-0ubuntu0.18.04.4+esm6, 2.6.1+dfsg1-0ubuntu0.20.04.2+esm4, 2.6.1+dfsg1-3ubuntu2.11, 2.11.5+dfsg1-1ubuntu0.1~esm6, 3.5.1+dfsg1-0ubuntu1.6, 3.16.0+dfsg-2ubuntu0.5, 3.24.2+dfsg-1ubuntu1.1
freerdp (Red Hat package) - addressed in versions 2.11.2-1.el9_4.9, 2.11.7-7.el9_8.4
freerdp - update to 2.11.7-10.0.1
freerdp-devel - update to 2.11.7-10.0.1
freerdp-libs - update to 2.11.7-10.0.1
libwinpr - update to 2.11.7-10.0.1
libwinpr-devel - update to 2.11.7-10.0.1
freerdp-doc - update to 2.11.7-10.0.1