CVE-2026-69159 FreeRDP: Out-of-Bounds Read in Planar RLE Decoder (planar_decompress_plane_rle / planar_decompress_plane_rle_only)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.29.0, planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c verify that a control byte exists but do not verify that the source buffer contains the zero to fifteen raw bytes declared by th...

CVE-2026-69159

This CVE is a duplicate of CVE-2026-67306; users should reference that identifier instead. The underlying vulnerability is an out-of-bounds read in FreeRDP prior to 3.29.0 , specifically in planar_decompress_plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c. The function...

CVE-2026-67306

FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15...

EUVD-2026-51835

FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15...

CVE-2026-67306

FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15...

PT-2026-67286

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description An out-of-bounds read exists in the RDP6 planar RLE bitmap decoder functions planar decompress plane rle and planar decompress plane rle only within libfreerdp/codec/planar.c. The system only perfor...