CVE-2026-57158 is a critical (CVSS 9.1) out-of-bounds read in the FreeRDP client's GFX planar decoder, from 3.21.0 up to before 3.28.0. It is an incomplete fix for an earlier CVE. A malicious RDP server can trigger it. Upgrade to 3.28.0 or later.
What's affected
The FreeRDP advisory (GHSA-mp3f-59pg-c5pp) says versions from 3.21.0 are affected and 3.28.0 is patched. The record gives the range as 3.21.0 up to but not including 3.28.0.
The affected function is planar_decompress_plane_rle_only in libfreerdp/codec/planar.c. It applies to clients that use the GFX pipeline. The advisory says the earlier fix for CVE-2026-23530 added size checks at the entry point of the decoder but missed this path, where one byte is read before the bounds check. A malicious server can reach it with a payload that is one byte short.
The impact is described as a one byte read past the input buffer.
How to check if you're exposed
xfreerdp /version
- Versions from 3.21.0 up to 3.27.x are in scope. Versions before 3.21.0 are outside the range in the record.
- Check tools that bundle FreeRDP, such as remote desktop clients, and the library version they link.
- Check container images and kiosk or thin client builds.
Run the free in-browser dependency scan at https://gold.safeguard.sh/scan against your manifest or lockfile. It lists vulnerable packages without installing anything.
What to do now
- Upgrade FreeRDP to 3.28.0 or later, or install your distribution's patched package.
- Update tools that bundle FreeRDP, and rebuild images that include it.
- Connect only to RDP servers you trust, until you have updated.
- Keep the updated version pinned in your build so an older package cannot return.
- Record where FreeRDP is embedded, so the next advisory is quick to answer.
Why it matters
The weakness is CWE-125, out-of-bounds read. The decoder read a byte before it checked that the byte was inside the buffer. A single byte is a small leak, which is why the damage is rated mainly as confidentiality and availability, but the vector is rated high because a malicious server needs no user action beyond the connection.
The history is the real lesson. An earlier fix covered the entry point but not an inner path. When a fix goes in, ask where else the same assumption lives. The record is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Is this the same bug as CVE-2026-23530?
No. The advisory calls it an incomplete fix for that earlier issue. It is a separate path in the planar decoder that the first fix did not cover.
Sources
Last reviewed: 19 October 2026.
