CVE-2026-45700 FreeRDP CVE debrief

Who should care

Organizations using FreeRDP for remote desktop connectivity, particularly those exposing RDP services to external networks or untrusted clients. Security teams responsible for vulnerability management in open-source remote access infrastructure. Developers integrating FreeRDP libraries into custom RDP client or server implementations.

Technical summary

The vulnerability stems from improper validation logic in `freerdp_bitmap_decompress_planar()` where coordinate checks intended for the final destination buffer are incorrectly applied to an internal temporary buffer. When processing RLE-compressed planar bitmap data, the function `planar_decompress_plane_rle()` writes decoded data to `pTempData` without adequate bounds verification. By manipulating `nDstStep` and `nXDst` values, an attacker can cause the RLE decompression to exceed the allocated size of `pTempData`, resulting in heap memory corruption. This weakness is classified as CWE-787 (Out-of-bounds Write). The CVSS 4.0 score of 7.7 (HIGH) reflects significant impacts to confidentiality, integrity, and availability with network accessibility and low attack complexity, though user interaction is required.

Defensive priority

HIGH

Recommended defensive actions

• Upgrade FreeRDP to version 3.26.0 or later to remediate the out-of-bounds heap write vulnerability in the planar bitmap decoder.
• If immediate patching is not feasible, restrict RDP connections to trusted sources and monitor for anomalous bitmap decoding operations that may indicate exploitation attempts.
• Review application logs for crashes or memory corruption indicators in FreeRDP processes handling RLE planar bitmap data.
• Assess client and server deployments of FreeRDP to identify systems running affected versions prior to 3.26.0.

Evidence notes

Vulnerability description sourced from NVD record published 2026-05-29T20:16:27.533Z. Fix version 3.26.0 confirmed in advisory. CVSS 4.0 vector indicates network attack vector with low attack complexity, attacker privileges none, user interaction present, high impact to confidentiality, integrity, and availability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.