CVE-2026-26965

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). A malicious RDP server can exploit a heap out-of-bounds write vulnerability in the planar_decompress_plane_rle() function. This vulnerability allows the server to write past the end of a temporary buffer, potentially overwriting critical data such as function pointers. This can lead to arbitrary code execution on the connecting FreeRDP client.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.