CVE-2026-111381: FreeRDP Heap Buffer Overflow Vulnerability

CVE-2026-111381 Overview

CVE-2026-111381 is a heap buffer overflow vulnerability in FreeRDP versions before 3.32.0. The flaw resides in the persistent_cache_read_entry_v2 function and stems from an integer wraparound during bitmap size calculation. A local attacker can craft a malicious persistent cache v2 file with oversized width and height values. When FreeRDP loads the file, mismatched entry size accounting combined with fixed 16 KiB reads corrupts heap memory. Successful exploitation can crash the client or lead to arbitrary code execution in the context of the FreeRDP process. The vulnerability is tracked under [CWE-122] (Heap-based Buffer Overflow).

Critical Impact
Attackers can trigger heap memory corruption in FreeRDP clients, enabling denial of service or local code execution when a malicious persistent bitmap cache file is loaded.

Affected Products

FreeRDP versions prior to 3.32.0
Applications and distributions that bundle the FreeRDP library
RDP client deployments relying on persistent bitmap caching

Discovery Timeline

2026-10-16 - CVE-2026-111381 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-111381

Vulnerability Analysis

The vulnerability affects FreeRDP's persistent bitmap cache v2 parser. The function persistent_cache_read_entry_v2 computes bitmap storage sizes using attacker-controlled width and height fields from the cache file. When these values are large enough, the multiplication wraps around and produces a smaller allocation than expected. FreeRDP then performs fixed 16 KiB reads into the undersized heap buffer, writing past its bounds. The resulting heap corruption can be exploited to influence adjacent allocations, control program state, or execute arbitrary code within the FreeRDP process context. Because exploitation requires local file access and user interaction to load the cache, the attack surface is limited to scenarios where a victim opens or imports a malicious persistent cache file.

Root Cause

The root cause is an unchecked integer arithmetic operation in the bitmap size calculation path. Width multiplied by height multiplied by bytes-per-pixel exceeds the integer type's range, wrapping to a small value. The allocator returns a buffer sized to the wrapped result, but the subsequent read loop uses the original 16 KiB block size, breaking the invariant between allocation size and write length.

Attack Vector

Exploitation requires local access and user interaction. An attacker places a crafted .pbcache file where FreeRDP will load it, either by convincing the user to import the file or by overwriting an existing persistent cache file in a writable directory. When FreeRDP parses the malformed entry during session initialization, the heap buffer overflow triggers. See the GitHub Security Advisory GHSA-26cc-wjh8-hjw6 and the VulnCheck FreeRDP Heap Overflow Advisory for additional technical analysis.

// No verified proof-of-concept code is available.
// Refer to the GHSA-26cc-wjh8-hjw6 advisory for technical details
// on the integer wraparound in persistent_cache_read_entry_v2.

Detection Methods for CVE-2026-111381

Indicators of Compromise

Unexpected crashes of FreeRDP clients (xfreerdp, wlfreerdp, sdl-freerdp) with heap corruption signatures in core dumps
Persistent bitmap cache files (.pbcache) with abnormally large width or height header fields
Modification of persistent cache files outside normal RDP session activity

Detection Strategies

Audit FreeRDP binary versions across endpoints and flag any installation reporting a version below 3.32.0
Inspect persistent cache files for width or height fields that would overflow 32-bit size calculations when multiplied by bytes-per-pixel
Monitor for process crashes in RDP client binaries and correlate them with recent cache file writes

Monitoring Recommendations

Enable crash telemetry and heap sanitizer logging in development and QA environments running FreeRDP
Collect file integrity monitoring events for user-writable paths containing persistent bitmap cache data
Alert on new or modified .pbcache files delivered via email, file shares, or download channels

How to Mitigate CVE-2026-111381

Immediate Actions Required

Upgrade all FreeRDP installations to version 3.32.0 or later
Identify downstream applications that embed FreeRDP and apply vendor-provided patches
Remove untrusted persistent bitmap cache files from user profile directories

Patch Information

The FreeRDP project addressed the issue in release 3.32.0. The fix adds bounds checking to the bitmap size calculation in persistent_cache_read_entry_v2 to prevent integer wraparound. Review the GitHub Security Advisory GHSA-26cc-wjh8-hjw6 for commit references and backport guidance.

Workarounds

Disable persistent bitmap caching in FreeRDP client configurations until patches are applied
Restrict write permissions on directories where FreeRDP reads persistent cache files
Avoid loading persistent cache files received from untrusted sources

bash

# Disable persistent bitmap cache when launching FreeRDP
xfreerdp /v:rdp.example.com /u:user -bitmap-cache +glyph-cache

# Verify installed FreeRDP version
xfreerdp --version