CVE-2026-111379: FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistentcachereadentryv3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persistcachegetdata, causing fread to overflow an undersized buffer and potentially execute code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-0ubuntu0.24.04.1 - Upgrade
Upgrade
ubuntu/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.0+dfsg-0ubuntu0.26.04.1 - Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems running FreeRDP versions before 3.32.0 are exposed if an attacker can supply or cause the use of a crafted v3 persistent cache file. Exploitation is local and requires low privileges plus user interaction.
What does an attacker need to control?
The attacker needs a crafted v3 persistent cache file with large width and height values. Those values can wrap the size calculation, causing data to be read into an undersized heap buffer.
What is the impact if exploitation succeeds?
Successful exploitation can corrupt memory and may allow code execution. The vulnerability affects confidentiality, integrity, and availability.