--- cve: "CVE-2026-45700" severity: "HIGH" cvss: 7.7 epss: "63%" vendor: "FreeRDP" kev: false exploited: false published: "2026-05-29 20:16:27" tags: [cve, security, high] source: tsecurity.de CVE-Dossier exported: "2026-09-11T01:09:59+02:00" --- # CVE-2026-45700 > 7.7 HIGH · 🧪 PoC ## Beschreibung FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's planar bitmap decoder has an out-of-bounds heap write when decoding RLE planar data. In libfreerdp/codec/planar.c, freerdp_bitmap_decompress_planar() validates the X destination coordinate nXDst against the caller-provided destination stride (nDstStep) even when it is writing into the internal temp buffer pTempData. An attacker can bypass the check with a large nDstStep and a large nXDst, causing planar_decompress_plane_rle() to write past the end of pTempData. This vulnerability is fixed in 3.26.0. ## CVSS-Vektor ``` CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Netzwerk | bad | | AC Komplexität | Gering | bad | | PR Privilegien | Keine | bad | ## Patch verfügbar (OSV) - 3f6d7cb1f8973cc84c66b258a9a61c4e2b2f30a6 (Commit) ## Referenzen - - - - - - - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-45700) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_