CVE-2026-67306: 
Wolfi vulnerability analysis and mitigation

CVE-2026-67306 is an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder of FreeRDP, affecting versions 3.28.0 and earlier. The flaw resides in the planar_decompress_plane_rle and planar_decompress_plane_rle_only functions within libfreerdp/codec/planar.c. It was discovered via fuzzing, confirmed with AddressSanitizer, and publicly disclosed on August 1, 2026, with a fix available in FreeRDP 3.29.0. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, FreeRDP Advisory).

The root cause is an insufficient bounds check (CWE-125: Out-of-bounds Read) in the RDP6 planar RLE decoder. The decoder validates only the 1-byte control byte (check A) and the destination scanline capacity (check B), but never verifies that the source buffer contains the 0–15 additional raw bytes declared by the attacker-controlled cRawBytes field extracted from the control byte. When a malicious or compromised RDP server sends a truncated planar-encoded bitmap — for example, a single control byte 0xF0 declaring 15 raw bytes against a 1-byte source buffer — the raw-byte read loop (check C) proceeds unconditionally past the end of the source buffer. The vulnerability is reachable post-connection via both the classic Bitmap Update PDU path and the RDPGFX Surface Command path (gdi_SurfaceCommand() → gdi_SurfaceCommand_Planar() → freerdp_bitmap_decompress_planar() → planar_decompress_plane_rle()). The sibling function planar_skip_plane_rle() in the same file correctly validates the full claimed length before reading, confirming this is an implementation inconsistency (FreeRDP Advisory).

Successful exploitation allows a malicious or compromised RDP server to cause the FreeRDP client to read memory beyond the bounds of the source buffer, resulting in potential disclosure of sensitive client-side memory contents and/or a client application crash (DoS). The vulnerability is a read-only primitive — no out-of-bounds write is associated with this specific bug — so integrity of the client system is not directly affected. The most likely outcome is a client crash on an unmapped-page hit, with memory disclosure dependent on the memory layout at the time of exploitation (FreeRDP Advisory, GitHub Advisory).

1. Set up a malicious RDP server: The attacker operates or compromises an RDP server reachable by the target FreeRDP client (e.g., via a rogue server, man-in-the-middle, or server compromise).
2. Lure the victim to connect: Social engineering or network-level redirection is used to cause the FreeRDP client (version ≤ 3.28.0) to initiate an RDP session to the attacker-controlled server.
3. Craft a malicious planar-encoded bitmap update: After the RDP session is established, the server sends a crafted Bitmap Update PDU or RDPGFX Surface Command containing a truncated planar-encoded bitmap. A minimal trigger is a single control byte 0xF0 (declaring cRawBytes=15, nRunLength=0) with a source buffer of only 1 byte.
4. Trigger the out-of-bounds read: The FreeRDP client's planar_decompress_plane_rle() function passes the control byte bounds check but then attempts to read 15 additional bytes from the 1-byte buffer, causing an out-of-bounds read in the raw-byte loop.
5. Achieve impact: Depending on memory layout, the client process crashes (DoS) or adjacent memory contents are read, potentially disclosing sensitive data from the client's process memory (FreeRDP Advisory).

• Network: Unusual or unexpected RDP connections from client systems to unknown or untrusted RDP server IP addresses; malformed RDP Bitmap Update PDUs or RDPGFX Surface Commands with anomalously short planar-encoded bitmap payloads.
• Logs: FreeRDP client logs containing WLog_ERR messages such as "error reading input buffer" from libfreerdp/codec/planar.c; application crash reports or core dumps originating from the FreeRDP process during an active RDP session.
• Process: Unexpected termination (crash) of the FreeRDP client process (xfreerdp, wfreerdp, or embedded FreeRDP-based applications) immediately after connecting to an RDP server or receiving a bitmap/surface update.

The primary remediation is to upgrade FreeRDP to version 3.29.0 or later, which includes the fix for this vulnerability (GitHub Advisory, FreeRDP Advisory). The fix adds a source-buffer bounds check for cRawBytes before the raw-byte read loop: if (cur + 1ull + cRawBytes > SrcSize) { return -1; }, applied to both planar_decompress_plane_rle() and planar_decompress_plane_rle_only(). As a workaround where immediate patching is not possible, restrict FreeRDP client connections to trusted, known-good RDP servers only, and monitor or filter suspicious RDP traffic at network boundaries.

The vulnerability was reported by researcher HEXER365 and published by FreeRDP maintainer akallabeth via a GitHub Security Advisory on July 15, 2026, with the CVE formally published on August 1, 2026. The advisory notes the finding was discovered via fuzzing and independently re-verified using an isolated harness, reflecting a rigorous disclosure process. No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time (FreeRDP Advisory).