CVE-2026-45700 is an out-of-bounds heap write in the planar bitmap decoder of FreeRDP, scored 9.8 (critical) in NVD. FreeRDP 3.25.0 and earlier are affected. Version 3.26.0 fixes it.
What's affected
The GitHub advisory lists FreeRDP 3.25.0 and earlier, with 3.26.0 as the patched release. The CVSS vector is AV:N/AC:L/PR:N/UI:N, so the NVD score assumes no privileges and no user action.
The advisory is more specific about who is exposed. It says third party implementations that use their own decoding system and call the FreeRDP planar decoder are affected, and that no FreeRDP server or client is affected as shipped. Its impact section still describes possible client process heap corruption through RDPGFX. Read it before you decide your risk, and when in doubt, upgrade.
Red Hat has published errata for its packages, including RHSA-2026:36203 and RHSA-2026:37207. Check them if you use Red Hat builds.
How to check if you're exposed
Find the installed version and any software that bundles FreeRDP.
xfreerdp --version
rpm -q freerdp
dpkg -l | grep -i freerdp
Remote desktop gateways, VDI clients and tools that embed libfreerdp may carry their own copy, so ask each vendor which version they ship.
What to do now
- Inventory FreeRDP on workstations, servers and container images.
- Upgrade to 3.26.0 or later, or to your distribution's patched package.
- Ask vendors of embedded RDP tooling for a build that includes the fix.
- If you cannot upgrade, the advisory suggests a code change: use
nTempStepinstead ofnDstStepin the bounds check. It is a suggested fix, not an official workaround.
Why it matters
The weakness is CWE-787, out-of-bounds write. In freerdp_bitmap_decompress_planar(), the check on the X destination coordinate uses the caller's destination stride even when the decoder writes into its own temporary buffer. A large stride and a large coordinate pass the check, and run-length decoding then writes past the buffer's end.
Heap writes of this kind can corrupt memory and may lead to code execution, which explains the high score. The KEV flag is false.
Quick check
Is CVE-2026-45700 exploited in the wild?
The record's KEV flag is false and the advisory I fetched does not say it is exploited.
Sources
Last reviewed: 19 October 2026.
