Out-of-Bounds Read in FreeRDP Windows RAIL Client
CVE-2026-111375

6.3MEDIUM

Key Information:

Vendor

Freerdp

Status
Freerdp
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111375?

FreeRDP versions prior to 3.32.0 are susceptible to an out-of-bounds read vulnerability within the Windows RAIL client. This allows malicious RDP servers to exploit the vulnerability by sending specially crafted, non-NUL-terminated window titles. When the client receives these updates, the wf_rail_window_common function processes them and passes the data to SetWindowTextW, which may lead to heap corruption or even client crashes. Users running affected versions are advised to update to the latest release to mitigate the risks associated with this vulnerability.

Affected Version(s)

FreeRDP 3.0.0 < 3.32.0

FreeRDP 3.32.0

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/freerdp-3.0.0-before...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kushalkhemka
mayank-jangid-moon
skigeek16
opensec-intelligence
.