CVE-2026-111379 in FreeRDP
Summary
by MITRE • 10/16/2026
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer and potentially execute code.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in FreeRDP versions prior to 3.32.0 represents a critical heap-based buffer overflow located within the persistent cache reading functionality, specifically inside the function named persistent_cache_read_entry_v3. This flaw arises from insufficient validation of input parameters when processing v3 format persistent cache files. The core technical issue stems from how dimensions are handled during data retrieval operations. When an attacker supplies a crafted file containing excessively large width and height values, these inputs trigger integer overflow conditions or logical errors in the size calculation logic within persist_cache_get_data. Instead of rejecting invalid dimension pairs that would result in unreasonably large memory allocations, the application proceeds to allocate buffers based on flawed arithmetic results. This miscalculation leads to an undersized buffer being allocated relative to the actual data volume intended for reading or processing.
During the execution flow, the fread function attempts to read data into this insufficiently sized heap buffer. Because the calculated size does not account for the true magnitude of the input dimensions due to wrapping or overflow behavior, the write operation exceeds the bounds of the allocated memory region. This out-of-bounds write corrupts adjacent heap metadata and potentially overwrites critical control structures within the process address space. Such corruption can lead to application crashes through segmentation faults in benign scenarios but poses a severe risk for arbitrary code execution if an attacker carefully crafts the overflow payload to overwrite function pointers, return addresses, or other executable controls on the stack or heap. The vulnerability is classified under CWE-120 Buffer Copy without Checking Size of Input and CWE-787 Out-of-bounds Write, reflecting both the mechanism of exploitation and the resulting memory corruption state.
From an operational perspective, this vulnerability primarily affects local attackers who have access to create or modify persistent cache files on the target system. Since FreeRDP is a remote desktop client that maintains session states in these cache files for performance optimization, an attacker with user-level privileges can place a maliciously crafted file in the appropriate directory structure. Upon subsequent connection attempts or cache refresh operations by the legitimate user or automated processes, the vulnerability is triggered. The impact includes denial of service through application instability and potential privilege escalation if combined with other local vulnerabilities to achieve code execution under higher-privileged contexts. In environments where FreeRDP is used extensively for remote access infrastructure, this flaw undermines the integrity of session persistence mechanisms and exposes systems to exploitation via social engineering or insider threats capable of manipulating client-side cache artifacts.
Mitigation strategies focus primarily on upgrading to version 3.32.0 or later, which addresses these input validation gaps by implementing strict bounds checking before buffer allocation and read operations. Security teams should also enforce least privilege principles for accounts running FreeRDP instances to limit the blast radius of any potential exploitation. Additionally, monitoring file system integrity for unexpected modifications in user cache directories can provide early detection indicators. From a defensive engineering standpoint, enabling compiler-based protections such as stack canaries, Address Space Layout Randomization, and Data Execution Prevention enhances resilience against heap overflow exploits by making reliable code execution more difficult even if the memory corruption occurs. The attack vector aligns with ATT&CK technique T1059 Command and Scripting Interpreter for initial access via crafted files or T1203 Exploitation for Client Applications when considering how such vulnerabilities are typically leveraged in real-world scenarios to compromise endpoint security postures.