Heap Buffer Overflow in FreeRDP Allows Local Attackers to Corrupt Memory

CVE-2026-111379

What is CVE-2026-111379?

FreeRDP versions prior to 3.32.0 are susceptible to a heap buffer overflow vulnerability within the persistent_cache_read_entry_v3 function. Local attackers can exploit this vulnerability by providing a specially crafted v3 persistent cache file. By specifying excessively large width and height values, attackers can manipulate the size calculations in the persist_cache_get_data function. This manipulation can lead to a buffer overflow when fread operates on an inadequately sized buffer, potentially allowing the execution of arbitrary code.

References