CVE-2026-111381 in FreeRDP
Summary
by MITRE • 10/16/2026
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes mismatched entry size accounting and fixed 16 KiB reads, leading to crashes or code execution when loaded.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in FreeRDP versions prior to 3.32.0 represents a critical security flaw rooted in improper input validation within the persistent cache reading mechanism. Specifically, the function persistent_cache_read_entry_v2 is susceptible to a heap buffer overflow caused by an integer wraparound error during bitmap size calculation. This issue arises when processing crafted persistent cache v2 files that contain manipulated width and height values. The core technical failure lies in how these dimensions are used to compute the expected entry size. When attackers supply oversized or specifically crafted dimension parameters, the arithmetic operation responsible for calculating the total byte count of the bitmap data undergoes integer overflow. This mathematical error results in a significantly smaller calculated size than what is actually present in the file, creating a discrepancy between the allocated heap memory and the amount of data subsequently read from disk.
From an operational perspective, this vulnerability allows local attackers to corrupt heap memory by exploiting the mismatched entry size accounting. The application proceeds to perform fixed 16 KiB reads based on the flawed calculation rather than validating against the actual file content or proper bounds checking mechanisms. This leads to out-of-bounds read operations that extend beyond the allocated buffer boundaries into adjacent heap regions. Such corruption can destabilize the memory allocator, leading to immediate application crashes and denial of service conditions. More critically, in environments where FreeRDP is used for remote desktop connections, successful exploitation could potentially lead to arbitrary code execution if an attacker can control the data written or read during this overflow event. The ability to manipulate heap metadata through such a flaw poses severe risks to system integrity and confidentiality.
This vulnerability aligns with Common Weakness Enumeration (CWE) categories including CWE-190 Integer Overflow or Wraparound, which describes the arithmetic error that initiates the exploit chain, and CWE-787 Out-of-bounds Write, although in this specific case it manifests primarily as an out-of-bounds read leading to heap corruption. In terms of attack vectors, this falls under local privilege escalation scenarios if the application runs with elevated privileges or can be triggered by a malicious user on the same system. It also relates to CWE-120 Buffer Copy without Checking Size of Input which highlights the lack of rigorous boundary checks during data ingestion from external sources like cache files. The exploitation technique leverages standard heap manipulation tactics, potentially allowing an attacker to achieve code execution through controlled memory corruption techniques such as overwriting function pointers or vtable entries if the overflow allows writing beyond the initial buffer limit due to subsequent operations triggered by the corrupted state.
Mitigation strategies for this vulnerability primarily involve upgrading FreeRDP to version 3.32.0 or later, where these integer arithmetic checks and boundary validations have been corrected. For organizations unable to immediately patch their systems, implementing strict input validation on persistent cache files is essential. This includes verifying that bitmap dimensions do not exceed reasonable limits before performing any size calculations. Additionally, enabling heap protection mechanisms such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) can mitigate the impact of exploitation by making it more difficult for attackers to predict memory layouts or execute injected code. Security teams should also monitor for unusual process behavior related to FreeRDP instances that may indicate attempted exploitation, particularly in multi-user environments where local users might attempt to target shared RDP sessions. Regular auditing of third-party dependencies and maintaining an up-to-date software inventory are critical components of a defense-in-depth strategy against such memory corruption vulnerabilities.