CVE-2026-31897 is an out-of-bounds read in FreeRDP's planar bitmap decompression. The function reads a byte without first checking that the source size is at least one. The NVD record carries no CVSS base score. Upgrade FreeRDP to 3.24.0 or later.
What's affected
FreeRDP 3.23.0 and earlier, per the advisory. The fixed version is 3.24.0.
The advisory traces one route through the RDP graphics channel, where a server can send a surface command with a length of zero and a valid data pointer. It says the older bitmap update path is not affected because it already checks the length.
How to check if you're exposed
FreeRDP is both a library and a set of clients, so check the build you actually run. For the command line client:
xfreerdp /version
Other tools that embed libfreerdp, such as remote desktop clients packaged by a Linux distribution or bundled inside another application, carry their own copy or depend on the distribution's package. Check your package manager for the installed version, for example apt list --installed 2>/dev/null | grep -i freerdp on Debian based systems.
What to do now
- Upgrade FreeRDP to 3.24.0 or later.
- Update any application or distribution package that bundles libfreerdp.
- Apply the same update for CVE-2026-31883 and CVE-2026-31885, which share this fixed release.
Why it matters
The class is CWE-125, out-of-bounds read. A missing check for a zero length input let the function read one byte past the end of the buffer.
This is the mildest of the three FreeRDP fixes in 3.24.0, and the record shows no CVSS score for it. A one byte over-read is more likely to produce a crash or a small information leak than anything larger. The reason to handle it is practical: you will upgrade for the other two anyway, and it is covered by the same release.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and no advisory I read says it is exploited in the wild. Treat it as a patch to schedule promptly, not a fire drill, unless your own logs say otherwise.
Quick check
Why is there no CVSS score?
The NVD record I read has a base score of zero, which means none was assigned. That does not mean the bug is harmless, only that it was not scored there.
Sources
Last reviewed: 19 October 2026.
