CVE-2026-111379: FreeRDP Heap Buffer Overflow Vulnerability

CVE-2026-111379 Overview

CVE-2026-111379 is a heap buffer overflow vulnerability in FreeRDP versions prior to 3.32.0. The flaw resides in the persistent_cache_read_entry_v3 function, which processes v3 persistent bitmap cache files. Attackers who supply a crafted cache file can trigger an integer wrap in the size calculation performed by persist_cache_get_data, causing fread to write past the end of an undersized heap buffer. The condition can lead to memory corruption and potentially arbitrary code execution in the context of the FreeRDP client process. The weakness is classified as [CWE-122] Heap-based Buffer Overflow.

Critical Impact
A local attacker with low privileges who convinces a user to open a malicious v3 persistent cache file can corrupt heap memory and achieve code execution within the FreeRDP process.

Affected Products

FreeRDP versions prior to 3.32.0
Applications embedding the FreeRDP client library for RDP connectivity
Downstream distributions packaging vulnerable FreeRDP builds

Discovery Timeline

2026-10-16 - CVE-2026-111379 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-111379

Vulnerability Analysis

FreeRDP implements persistent bitmap caching to speed up repeated RDP sessions by storing bitmap tiles on disk. The v3 cache format records per-entry dimensions, including width and height fields that persist_cache_get_data multiplies to determine the allocation and read size. When an attacker crafts a cache file with large width and height values, the arithmetic overflows a fixed-width integer and produces a small size value. FreeRDP then allocates an undersized heap buffer and calls fread with the attacker-controlled, pre-wrap length, writing attacker data far beyond the allocation boundary.

Root Cause

The root cause is a missing bounds check on the product of width and height before it is used as both an allocation size and an I/O length. The size calculation in persist_cache_get_data does not validate against integer wrap, allowing a mismatch between buffer capacity and the number of bytes read from the cache file. This classic size/length desynchronization is the pattern behind [CWE-122] heap corruption.

Attack Vector

Exploitation requires local access and user interaction. An attacker places a malicious v3 persistent cache file in a location that FreeRDP will load, or convinces a user to use it, typically through a crafted profile or shared workspace. When FreeRDP parses the entry, the integer wrap triggers the overflow during fread. Successful exploitation yields memory corruption that can be shaped into arbitrary code execution with the privileges of the user running the FreeRDP client. A proof-of-concept demonstrating the overflow is published in the FreeRDP persistent cache v3 heap overflow repository.

No verified exploitation code is reproduced here. See the GitHub Security Advisory GHSA-945c-qq5h-jqwp and the VulnCheck FreeRDP advisory for the full technical write-up.

Detection Methods for CVE-2026-111379

Indicators of Compromise

Unexpected v3 persistent bitmap cache files appearing in FreeRDP cache directories such as ~/.local/share/freerdp/cache/ on Linux or the equivalent AppData path on Windows.
FreeRDP client crashes or heap corruption aborts logged shortly after loading a persistent cache entry.
Cache files with abnormally large width or height header fields relative to legitimate bitmap tiles.

Detection Strategies

Hunt for FreeRDP (xfreerdp, wfreerdp, freerdp) processes exiting with signals indicating heap corruption, such as SIGABRT from glibc malloc checks.
Alert on writes to FreeRDP cache directories originating from processes other than the FreeRDP client itself.
Parse persistent cache file headers in security tooling and flag entries where width * height exceeds expected per-tile sizes.

Monitoring Recommendations

Inventory FreeRDP installations across endpoints and track versions against the fixed release 3.32.0.
Monitor execution of RDP client binaries that load cache files from user-writable or network-shared locations.
Correlate FreeRDP crash telemetry with recent file writes to cache directories to identify triage-worthy events.

How to Mitigate CVE-2026-111379

Immediate Actions Required

Upgrade FreeRDP to version 3.32.0 or later on all systems where the client or its libraries are installed.
Rebuild and redeploy any downstream applications that statically link or bundle a vulnerable FreeRDP build.
Audit and remove untrusted persistent cache files from user profiles before re-enabling caching.

Patch Information

The FreeRDP maintainers addressed the issue in version 3.32.0. Details and patch references are documented in GitHub Security Advisory GHSA-945c-qq5h-jqwp. Linux distribution users should install the vendor-provided FreeRDP update that incorporates the fix.

Workarounds

Disable persistent bitmap caching in FreeRDP connection profiles until the client is patched.
Restrict FreeRDP cache directories to the owning user and prevent other processes from writing to them.
Avoid opening RDP profiles or cache files received from untrusted sources.

bash

# Disable persistent bitmap cache when launching the FreeRDP client
xfreerdp /v:rdp.example.com /u:user -bitmap-cache +glyph-cache

# Verify installed FreeRDP version meets or exceeds the fixed release
xfreerdp --version