What’s Vulnerable › Vulnerabilities
CVE-2026-111379: FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3
- Severity: high (CVSS 7.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-10-16 · updated 2026-10-28
- Weakness: CWE-122
Description
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer and potentially execute code.
Affected products
How to fix
Upgrade to a fixed version: FreeRDP 3.32.0; FreeRDP 3.32.0. Check the vendor advisory for mitigations.
References
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-945c-qq5h-jqwp
- https://github.com/programmervuln/freerdp-persistent-cache-v3-heapoverflow
- https://www.vulncheck.com/advisories/freerdp-before-3.32.0-heap-buffer-overflow-via-persistent-cache-read-entry-v3
- https://github.com/programmervuln/freerdp-persistent-cache-v3-heapoverflow
Get alerted when CVE-2026-111379 or the next vulnerability affects your stack