CVE-2026-111379 FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3
Local attackers can execute arbitrary code by supplying a crafted persistent cache file to FreeRDP, causing a heap buffer overflow.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-111379?
CVE-2026-111379 is a high-severity memory corruption vulnerability in Freerdp Freerdp, published on 16 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer and potentially execute code.
Weakness: CWE-122
Which versions are affected by CVE-2026-111379?
It affects 1 product.
Products include Freerdp Freerdp.
How do I fix CVE-2026-111379?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-111379 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111379 exists.
Other vulnerabilities in Freerdp Freerdp
- CVE-2021-37594 Other in n/a
- CVE-2021-37595 Other in n/a
- CVE-2026-67305 FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr
- CVE-2026-66402 FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass
- CVE-2026-67289 FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
Sources
Also known as DEBIAN-CVE-2026-111379, GHSA-945c-qq5h-jqwp, GHSA-hx89-54wj-ffmg, UBUNTU-CVE-2026-111379.