A malformed planar bitmap update delivered by a malicious RDP server can trigger an out-of-bounds read in the FreeRDP planar bitmap decoder. The missing verification of the number of raw bytes specified by a control byte allows the decoder to read beyond the supplied source buffer, potentially causing a crash or revealing data stored in memory adjacent to the buffer. The vulnerability is classified as a memory disclosure or denial‑of‑service issue (CWE‑125).

Any installation of the FreeRDP client earlier than version 3.29.0 is susceptible. The bug is present in the planar_decompress_plane_rle and planar_decompress_plane_rle_only functions within libfreerdp/codec/planar.c. Version 3.29.0 and later contain the fix and are not affected.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting no validated exploit is publicly known yet. An attacker could remotely deliver a crafted RDP session to a vulnerable client; the flaw does not grant code execution, but it can crash the client or leak sensitive information from memory. The risk is therefore moderate to high in environments that accept connections from untrusted RDP servers.