CVE-2026-111381: FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistentcachereadentryv2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes mismatched entry size accounting and fixed 16 KiB reads, leading to crashes or code execution when loaded.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs local access and low privileges, and must be able to place or modify a persistent cache v2 file that FreeRDP will load. Exploitation also requires user interaction to load the crafted cache file.
What is the affected version boundary?
FreeRDP versions before 3.32.0 are affected. Updating to 3.32.0 or later removes the known affected version range.
What can happen if a crafted cache file is loaded?
The malformed width and height values can trigger integer wraparound and heap memory corruption during persistent cache v2 parsing. This may cause a crash or potentially permit code execution.