CVE-2026-111379GHSA-945c-qq5h-jqwp
FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3
FreeRDP FreeRDP
CVSS
7.0HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 16 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.32.0FreeRDPCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer and potentially execute code.
Text from CVE List
Affected versions 2
- FreeRDPaffected: all versions before 3.32.0CVE List
- FreeRDPunaffected: 3.32.0CVE List