Heap Out-of-Bounds Write in FreeRDP Remote Desktop Implementation

CVE-2026-26965

What is CVE-2026-26965?

The FreeRDP implementation of the Remote Desktop Protocol contains a vulnerability prior to version 3.23.0 that allows a malicious RDP server to exploit out-of-bounds writes. This occurs in the RLE planar decode function, where there is inadequate verification of destination parameters, leading to the potential for heap overflow. An attacker can manipulate the pixel data being written, resulting in corruption of function pointers within adjacent structures upon the heap. When the destination format differs from the temporary format, the improper handling can escalate privileges, enabling the attacker to gain unexpected control of the application's execution flow. This critical flaw emphasizes the importance of upgrading to version 3.23.0 or later.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References