CVE-2026-111375: FreeRDP Buffer Overflow Vulnerability

CVE-2026-111375 Overview

CVE-2026-111375 is an out-of-bounds read vulnerability in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). The flaw affects FreeRDP versions 3.0.0 through 3.31.x and is fixed in 3.32.0. The issue resides in the Windows Remote Application Integrated Locally (RAIL) client, where wf_rail_window_common passes a non-NUL-terminated window title directly to SetWindowTextW. A malicious RDP server can exploit this by sending a full-length WINDOW_ORDER_FIELD_TITLE update, causing the client to over-read adjacent heap memory. The result is window title corruption, potential information disclosure, or client crashes.

Critical Impact
A malicious RDP server can trigger heap over-reads in connected FreeRDP Windows RAIL clients, leading to memory disclosure or denial of service.

Affected Products

FreeRDP 3.0.0 through 3.31.x (Windows RAIL client)
Applications and distributions embedding vulnerable FreeRDP builds
Any downstream RDP client leveraging the wf_rail_window_common code path

Discovery Timeline

2026-10-16 - CVE-2026-111375 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-111375

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds read [CWE-125] within FreeRDP's Windows RAIL client. RAIL extends RDP to allow seamless integration of remote applications into the local desktop, including propagation of window metadata such as titles. When the server sends a WINDOW_ORDER_FIELD_TITLE update, the client parses the payload and forwards the title string to the Win32 API SetWindowTextW. That API requires a NUL-terminated wide-character string.

FreeRDP's wf_rail_window_common function does not verify or enforce NUL termination on the received title buffer before passing it to SetWindowTextW. When the server supplies a maximum-length title without a terminator, SetWindowTextW reads beyond the allocated buffer until it encounters a null word in adjacent heap memory. This leaks heap contents into the window title and can crash the client when invalid memory is dereferenced.

Root Cause

The root cause is missing input validation on server-controlled string data. The RAIL title parser trusts the length field provided by the server and omits an explicit NUL terminator before invoking a Win32 string API that assumes one is present. The code path lacks a bounded-copy routine that would truncate or append a terminator.

Attack Vector

Exploitation requires a victim to initiate an RDP connection to an attacker-controlled or compromised server. The attacker crafts a RAIL WINDOW_ORDER_FIELD_TITLE update with a title filling the full declared length and omitting the terminating NUL. Upon processing, the FreeRDP client reads past the buffer boundary. Attack complexity is elevated because the attacker must induce or redirect the client to connect to the malicious server, and user interaction is not required once the session is established.

No public proof-of-concept exploit is listed, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.262%.

Detection Methods for CVE-2026-111375

Indicators of Compromise

Unexpected FreeRDP client crashes or abnormal terminations shortly after establishing RAIL sessions
Rendered application window titles containing garbled, binary, or non-printable characters
Outbound RDP connections from workstations to untrusted or non-corporate RDP endpoints

Detection Strategies

Inventory endpoint software to identify FreeRDP builds between 3.0.0 and 3.31.x and prioritize them for patching
Monitor process telemetry for wfreerdp.exe or embedded FreeRDP processes that exit abnormally after RAIL negotiation
Inspect RDP traffic metadata for RAIL window order activity originating from untrusted servers

Monitoring Recommendations

Enable EDR process-crash collection and correlate wfreerdp.exe faults with recent remote connections
Alert on RDP outbound connections to destinations outside sanctioned jump hosts or RDP gateways
Track installed package versions of freerdp across managed Windows endpoints for drift detection

How to Mitigate CVE-2026-111375

Immediate Actions Required

Upgrade FreeRDP to version 3.32.0 or later on all Windows endpoints running the RAIL client
Restrict outbound RDP (TCP/3389) connectivity to approved internal destinations only
Educate users to avoid connecting to untrusted RDP servers, including those reached via phishing links or .rdp attachments

Patch Information

The FreeRDP project released the fix in version 3.32.0. Details are provided in the GitHub Security Advisory GHSA-3rvr-qvx8-rj23 and the VulnCheck Advisory for FreeRDP. Downstream distributions that package FreeRDP should rebuild against the patched release.

Workarounds

Disable RAIL (RemoteApp) features in FreeRDP client invocations where seamless window integration is not required
Enforce the use of trusted RDP gateways and certificate validation to prevent connections to rogue servers
Apply network segmentation to block arbitrary outbound RDP traffic from user workstations until patching completes

bash

# Verify FreeRDP client version on Windows endpoints
wfreerdp.exe /version

# Launch FreeRDP without enabling RemoteApp (RAIL) features
wfreerdp.exe /v:<trusted-server> /cert:tofu