CVE-2026-57158

Katalog CVE

CVSS 9.1 · Critical EPSS 0,69%

Kerentanan Out-of-bounds Read pada freerdp. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

FreeRDP is a free implementation of the Remote Desktop Protocol. From 3.21.0 before 3.28.0, FreeRDP clients using the GFX pipeline contain an incomplete fix for CVE-2026-23530 in planar_decompress_plane_rle_only in libfreerdp/codec/planar.c, allowing a malicious RDP server to send a truncated RDPGFX_CMDID_WIRETOSURFACE_1 planar payload that reads one byte past the input buffer. This issue is fixed in version 3.28.0.

Rincian

Terbit di NVD

10 Juli 2026

Terakhir diubah

14 Juli 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

0,69% peluang dieksploitasi; lebih tinggi dari 51,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mp3f-59pg-c5pp exploit · advisory vendor
• https://github.com/FreeRDP/FreeRDP/commit/a7e797626fcb7f1d556ce63febb84f9f4a822731 patch
• https://github.com/FreeRDP/FreeRDP/pull/12952 patch
• https://github.com/FreeRDP/FreeRDP/releases/tag/3.28.0 release notes