2519828 – (CVE-2026-69159) CVE-2026-69159 FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service and information disclosure

Bug 2519828 (CVE-2026-69159) - CVE-2026-69159 FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service and information disclosure

Summary: CVE-2026-69159 FreeRDP: FreeRDP: Out-of-bounds read leads to denial of servic...

Keywords:
Status:	NEW
Alias:	CVE-2026-69159
Product:	Security Response
Classification:	Other
Component:	vulnerability
Sub Component:
Version:	unspecified
Hardware:	All
OS:	Linux
Priority:	medium
Severity:	medium
Target Milestone:	---
Assignee:	Product Security
QA Contact:
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2026-08-19 18:19 UTC by OSIDB Bzimport
Modified:	2026-09-17 17:54 UTC (History)
CC List:	2 users (show)
Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2026:61378	0	None	None	None	2026-08-31 12:41:36 UTC
Red Hat Product Errata	RHSA-2026:68706	0	None	None	None	2026-09-17 17:54:53 UTC

Description OSIDB Bzimport 2026-08-19 18:19:24 UTC

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.29.0, planar_decompress_plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c verify that a control byte exists but do not verify that the source buffer contains the zero to fifteen raw bytes declared by that control byte. A malicious RDP server can send a truncated planar bitmap or surface update whose final control byte claims additional raw bytes, causing the decoder to read beyond pSrcData while processing a color plane. This can crash the client and may disclose adjacent memory. This issue is fixed in version 3.29.0.

Comment 2 errata-xmlrpc 2026-08-31 12:41:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:61378 https://access.redhat.com/errata/RHSA-2026:61378

Comment 4 Jon Orris 2026-09-17 17:54:52 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:68706 https://access.redhat.com/errata/RHSA-2026:68706

Note You need to log in before you can comment on or make changes to this bug.