CVE Feed

    Dashboard / CVE / CVE-2026-111381

    CVE-2026-111381

    FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes mismatched entry size accounting and fixed 16 KiB reads, leading to crashes or code execution when loaded.

    Published:Oct 16, 2026
    Last Modified:Oct 16, 2026
    EPS:Oct 16, 2026
    EPSS Score:0.00124
    CVSS Score:7.3

    Affected Products

    Vendor
    Freerdp
    Product
    Freerdp

    Exploits

    https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-26cc-wjh8-hjw6https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-26cc-wjh8-hjw6

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-92 Forced Integer Overflow

    Related CVEs

    CVE-2026-114047 (CVSS 7.6) — FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that a…
    CVE-2026-114045 (CVSS 8.7) — FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integ…
    CVE-2026-114046 (CVSS 7.1) — FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accept…
    CVE-2026-114044 (CVSS 6.9) — FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malic…
    CVE-2026-114042 (CVSS 7.1) — FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream w…
    CVE-2026-114043 (CVSS 7.1) — FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis be…
    CVE-2026-114041 (CVSS 6.9) — FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that…
    CVE-2026-111881 (CVSS 7.2) — FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched st…
    CVE-2026-111880 (CVSS 8.3) — FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM …
    CVE-2026-111382 (CVSS 8.7) — FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 an…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High