Log in Start free

Vulnerability · Published Jul 10, 2026 · Assigned by GitHub_M

CVE-2026-57158FreeRDP planar_decompress_plane_rle_only: heap OOB read — incomplete fix for CVE-2026-23530

Medium 5.1

In plain English

A medium-severity out-of-bounds read in FreeRDP from FreeRDP. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.1Medium
Exploit odds (30 days)0.7%top 47.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

FreeRDP is a free implementation of the Remote Desktop Protocol. From 3.21.0 before 3.28.0, FreeRDP clients using the GFX pipeline contain an incomplete fix for CVE-2026-23530 in planar_decompress_plane_rle_only in libfreerdp/codec/planar.c, allowing a malicious RDP server to send a truncated RDPGFX_CMDID_WIRETOSURFACE_1 planar payload that reads one byte past the input buffer. This issue is fixed in version 3.28.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24freerdp3.29.0-r0ALPINE-CVE-2026-57158
Debian:12freerdp2no fix listedDEBIAN-CVE-2026-57158
Debian:13freerdp3no fix listedDEBIAN-CVE-2026-57158
Debian:14freerdp33.28.0+dfsg-1DEBIAN-CVE-2026-57158
Ubuntu:22.04:LTSfreerdp2no fix listedUBUNTU-CVE-2026-57158
Ubuntu:24.04:LTSfreerdp33.30.0+dfsg-0ubuntu0.24.04.1USN-8561-1
Ubuntu:24.04:LTSfreerdp33.30.0+dfsg-0ubuntu0.24.04.1UBUNTU-CVE-2026-57158
Ubuntu:25.10freerdp3no fix listedUBUNTU-CVE-2026-57158
Ubuntu:26.04:LTSfreerdp33.30.0+dfsg-0ubuntu0.26.04.1USN-8561-1
Ubuntu:26.04:LTSfreerdp33.30.0+dfsg-0ubuntu0.26.04.1UBUNTU-CVE-2026-57158

Affected products (as reported)

VendorProductVersions
FreeRDP FreeRDP >= 3.21.0, < 3.28.0

Weakness: CWE-125 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

References