CVE-2026-111379
Received Received - Intake

Heap Buffer Overflow in FreeRDP

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer and potentially execute code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111379
EUVD
EUVD-2026-102560

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111379 is a heap buffer overflow in FreeRDP's v3 persistent cache parser. It occurs when parsing a malicious cache file with large width and height values that cause a 64-bit integer wraparound during size calculation. This leads to an undersized buffer being allocated but later overflowed by fread, potentially allowing arbitrary code execution.

Detection Guidance

To detect this vulnerability, check the FreeRDP version installed on your system. Run: freerdp2-shadow --version or apt list --installed | grep freerdp. If the version is below 3.32.0, the system is vulnerable. Inspect persistent cache files for unusual size values in width and height fields.

  • Check FreeRDP version: freerdp2-shadow --version or apt list --installed | grep freerdp.
  • Review persistent cache files for malformed width/height values that could indicate exploitation.
Impact Analysis

An attacker with local access could exploit this to corrupt memory, crash the application, or execute arbitrary code on your system. This requires supplying a specially crafted v3 persistent cache file to the vulnerable FreeRDP version.

Compliance Impact

This vulnerability primarily affects local system integrity by allowing memory corruption or arbitrary code execution through crafted cache files. It does not directly impact data confidentiality or privacy controls required by GDPR or HIPAA. However, if exploited, it could lead to unauthorized access or system compromise, indirectly risking compliance by exposing sensitive data or disrupting secure environments.

Mitigation Strategies

Immediately update FreeRDP to version 3.32.0 or later. Remove or restrict access to persistent cache files until patched. Monitor systems for unusual memory corruption or crashes that may indicate exploitation attempts.

  • Update FreeRDP: sudo apt update && sudo apt upgrade freerdp2.
  • Restrict access to persistent cache files and delete suspicious files.
  • Monitor for crashes or memory corruption as potential exploitation signs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111379. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart