CVE-2026-111375: FreeRDP 3.0.0 before 3.32.0 Out-of-Bounds Read via RAIL Window Title

Q: Which deployments are exposed to this issue?

FreeRDP versions from 3.0.0 up to, but not including, 3.32.0 are affected when acting as a Windows RAIL client.

Q: What must an attacker control to trigger the vulnerability?

An attacker needs to operate or control a malicious RDP server and send a full-length WINDOW_ORDER_FIELD_TITLE update with a non-NUL-terminated window title. No client-side privileges or user interaction are required according to the supplied vector.

Q: What is the practical impact on an affected client?

The malicious title can cause a heap out-of-bounds read when it is passed to SetWindowTextW. This may corrupt displayed titles or crash the FreeRDP client.

Published Oct 16, 2026

Updated

FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOWORDERFIELDTITLE update that wfrailwindowcommon passes to SetWindowTextW, corrupting titles or crashing the client.

Affected Software

1 affected component

FreeRDP freerdp>=3.0.0<3.32.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.32.0

Event History

Oct 16, 2026

CVE Published

via MITRE·01:17 AM

Data Sourced

via MITRE·01:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

FreeRDP versions from 3.0.0 up to, but not including, 3.32.0 are affected when acting as a Windows RAIL client.

What must an attacker control to trigger the vulnerability?

An attacker needs to operate or control a malicious RDP server and send a full-length WINDOW_ORDER_FIELD_TITLE update with a non-NUL-terminated window title. No client-side privileges or user interaction are required according to the supplied vector.

What is the practical impact on an affected client?

The malicious title can cause a heap out-of-bounds read when it is passed to SetWindowTextW. This may corrupt displayed titles or crash the FreeRDP client.

CVE-2026-111375: FreeRDP 3.0.0 before 3.32.0 Out-of-Bounds Read via RAIL Window Title

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker control to trigger the vulnerability?

What is the practical impact on an affected client?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker control to trigger the vulnerability?

What is the practical impact on an affected client?