CVE-2026-26965 - Vulnerability Analysis

Overview

FreeRDP < 3.23.0 contains a heap out-of-bounds write caused by improper bounds checking in the RLE planar decode path, letting a malicious RDP server overwrite function pointers on the client, exploit requires a malicious server.

Severity & Score

Impact

A malicious RDP server can overwrite client memory, leading to arbitrary code execution on the client system.

Mitigation

Update to version 3.23.0 or later.

References

• https://github.com/FreeRDP/FreeRDP/commit/a0be5cb87d760bb1c803ad1bb835aa1e73e62abc
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5vgf-mw4f-r33h

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 26, 2026

🟠 CVE-2026-26965 - High (8.8) FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, `planar_decompress_plane_rle()` writes into `pDstData` at `((nYDst+y) * nDstStep) + (4*nXDst) + nChannel` without verifying th... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26965/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner