CVE-2026-67306 FreeRDP CVE debrief

Who should care

Organizations using FreeRDP versions 3.28.0 and earlier should be aware of the out-of-bounds read vulnerability and take steps to upgrade to version 3.29.0 or later. This includes reviewing and updating affected systems, monitoring for potential exploitation attempts, and verifying deployments to ensure they are not exposed.

Technical summary

The out-of-bounds read vulnerability in FreeRDP versions 3.28.0 and earlier occurs in the RDP6 planar RLE bitmap decoder functions. A malicious or compromised RDP server can send a truncated planar-encoded bitmap or surface update that causes the client to read past the end of the source buffer. This issue can be addressed by upgrading to FreeRDP 3.29.0, which fixes the vulnerability. The vulnerability is caused by insufficient bounds checking in the planar_decompress_plane_rle and planar_decompress_plane_rle_only functions in libfreerdp/codec/planar.c. The functions do not properly validate the source buffer, allowing an attacker to send a specially crafted planar-encoded bitmap or surface update that triggers the out-of-bounds read.

Defensive priority

Organizations using FreeRDP versions 3.28.0 and earlier should prioritize upgrading to version 3.29.0 to address the out-of-bounds read vulnerability.

Recommended defensive actions

• Upgrade to FreeRDP version 3.29.0 or later
• Review and update affected systems
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record indicates an out-of-bounds read vulnerability in FreeRDP versions 3.28.0 and earlier. The issue is fixed in FreeRDP 3.29.0. Evidence is limited; further verification is recommended. Organizations should verify their deployments, review official advisories, and plan for updates or mitigations. Compensating controls and monitoring may be necessary for exposed systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.