CVE-2026-45700: Heap-buffer-overflow write in planar bitmap decoder

Synopsis

A heap buffer overflow in FreeRDP's planar bitmap decoder lets a remote attacker write past the end of an internal temp buffer when decoding crafted RLE planar data. The bug is reachable over the network without authentication, but the victim must initiate or accept a session against an attacker-controlled RDP endpoint, and successful exploitation can corrupt heap memory leading to crashes or code execution in the FreeRDP client process. A patched-image rebuild at FreeRDP 3.26.0 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker reaches the victim over the network by serving crafted RDP planar bitmap data from a malicious or compromised RDP server.

• AuthenticationNot required

  No credentials on the victim system are needed; the decoder bug is hit during normal session handling.

• Victim interactionRequired

  A user must initiate or accept an RDP session to the attacker-controlled endpoint, so the vector is phishing-style social engineering toward an RDP connection.

• Attack complexityDetail

  AC:L indicates the exploit path through the planar decoder is reliable, though AT:P notes some attack requirements on the target environment.

Blast Radius

• Writes past the end of the pTempData heap buffer inside the FreeRDP client process, corrupting adjacent heap structures.
• With CVC:H/VI:H this typically escalates to arbitrary code execution in the context of the user running the RDP client.
• Crashes or hangs the FreeRDP client (VA:H), terminating the active remote session and any unsaved work tied to it.
• Impact is confined to the vulnerable client process; the CVSS subsequent-system scores are all None.