Dashboard / CVE-2026-111381

CVE-2026-111381

HIGH
MEDIUM Priority: 0.01 BB Relevance: 29/100
Published: 2026-10-16 Modified: 2026-10-28 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: Low
UI: Passive
AT: None
VC: High
VI: High
VA: High

Description

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes mismatched entry size accounting and fixed 16 KiB reads, leading to crashes or code execution when loaded.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
FreeRDP FreeRDP 0 < 3.32.0
freerdp freerdp < 3.32.0

References & Advisories (2)

Bug Bounty Relevance

29 / 100
✓ Low complexity

CVSS Score

7.0 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.18%
Raw Score 0.001760
Percentile 7.1%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00176
2026-10-28
0.00176

Intelligence Sources

mitre ref →

External Links