CVE-2026-111379: 
Wolfi vulnerability analysis and mitigation

CVE-2026-111379 is a heap buffer overflow vulnerability in FreeRDP's persistent_cache_read_entry_v3 function that allows local attackers to corrupt memory and potentially execute arbitrary code by supplying a crafted v3 persistent cache file. It affects all FreeRDP versions before 3.32.0 (i.e., ≤ 3.31.1). The vulnerability was published on October 16, 2026, with the corresponding GitHub Security Advisory (GHSA-945c-qq5h-jqwp) published October 1, 2026. It carries a CVSS v3.1 base score of 7.3 (High) and a CVSS v4.0 base score of 7.0 (High) (GitHub Advisory, FreeRDP Advisory, Red Hat Bugzilla).

The root cause is a 64-bit unsigned integer wraparound (CWE-190) leading to a heap-based buffer overflow (CWE-122) in libfreerdp/cache/persistent.c. In persist_cache_get_data, the bitmap byte size is calculated as 4ull * entry->width * entry->height; when an attacker supplies large width and height values (e.g., width=3221225474, height=3), the multiplication wraps around to a small value (e.g., 0x18 / 24 bytes), bypassing the expected > UINT32_MAX guard check. The tainted size is then truncated during heap allocation via winpr_aligned_recalloc, resulting in a 1-byte buffer, while the subsequent fread call uses the unwrapped size (24 bytes) as the read length — writing 24 bytes into a 1-byte heap region. Exploitation requires the attacker to supply a malicious v3 persistent cache file to a FreeRDP process, which requires low privileges and passive user interaction (e.g., a user opening an RDP session that loads the cache). A public PoC repository and crash log are referenced in the advisory (FreeRDP Advisory, GitHub Advisory).

Successful exploitation results in a heap buffer overflow write, which can cause memory corruption, process crash (denial of availability), or arbitrary code execution under the security context of the FreeRDP process. The confidentiality, integrity, and availability of the vulnerable system are all rated High, meaning an attacker could potentially read sensitive data from memory, modify process state, or crash the RDP client. The scope is limited to the vulnerable system (no lateral movement to subsequent systems is indicated by the CVSS scoring), but code execution under the FreeRDP process context could expose RDP session credentials or session data (FreeRDP Advisory, Red Hat Bugzilla).

As of the disclosure date, there is no evidence of in-the-wild exploitation and no public proof-of-concept exploit code beyond the crash log and PoC generator referenced in the FreeRDP security advisory. The EPSS score is 0.0, indicating very low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and passive user interaction (the target must open an RDP session that loads the malicious cache file), which limits the attack surface compared to remote or unauthenticated vulnerabilities (FreeRDP Advisory, GitHub Advisory).

1. Craft a malicious v3 persistent cache file: Generate a binary file conforming to the FreeRDP v3 persistent cache format, setting width = 3221225474 and height = 3. This causes 4ull * width * height to wrap around to 0x18 (24), bypassing the expected > UINT32_MAX check in persist_cache_get_data.
2. Place the malicious cache file: As a low-privileged local attacker, place the crafted poc.bin file in a location where the target FreeRDP process will load it as its persistent cache (e.g., the user's FreeRDP cache directory, typically ~/.cache/freerdp/).
3. Trigger cache loading: Wait for or induce the victim user to initiate an RDP session using FreeRDP (passive user interaction). FreeRDP will attempt to parse the v3 persistent cache file via persistent_cache_read_entry_v3.
4. Trigger integer wraparound and heap allocation: The parser calls persist_cache_get_data, which computes the wrapped size 0x18 and allocates a 1-byte heap buffer via winpr_aligned_recalloc.
5. Trigger heap buffer overflow: fread is called with the unwrapped size (24 bytes) as the read length into the 1-byte buffer, writing 24 bytes out-of-bounds on the heap.
6. Achieve code execution or crash: Depending on heap layout and exploitation technique, the out-of-bounds write may corrupt adjacent heap metadata or function pointers, potentially enabling arbitrary code execution under the FreeRDP process context, or at minimum causing a crash (FreeRDP Advisory).

• File System: Unexpected or modified files in the FreeRDP persistent cache directory (e.g., ~/.cache/freerdp/ on Linux) with anomalous file sizes or binary content inconsistent with legitimate cache entries; cache files with unusually large width/height field values (e.g., width near 0xC0000002).
• Process: FreeRDP process (xfreerdp, wlfreerdp) crashing with segmentation fault or heap corruption errors; AddressSanitizer or similar runtime reports of heap-buffer-overflow WRITE inside persistent_cache_read_entry_v3.
• Logs: Core dump files generated by FreeRDP process crashes; system logs (e.g., /var/log/syslog, journalctl) showing FreeRDP process termination with signal 11 (SIGSEGV) or signal 6 (SIGABRT) during RDP session startup; application logs referencing persistent.c or persistent_cache_read_entry_v3 in stack traces.

The primary remediation is to upgrade FreeRDP to version 3.32.0 or later, which contains the fix for this vulnerability (FreeRDP Advisory, GitHub Advisory). As a workaround where upgrading is not immediately possible, restrict filesystem permissions on FreeRDP persistent cache directories so that only the owning user can write cache files, preventing a low-privileged attacker from placing a malicious cache file. Additionally, disabling the FreeRDP persistent cache feature (if supported by the deployment configuration) eliminates the vulnerable code path. Apply the principle of least privilege to accounts running FreeRDP to limit the impact of any successful exploitation (Red Hat Bugzilla).

Red Hat has tracked this vulnerability via their security response process (Bugzilla bug 2553911), classifying it as high severity and high priority, with dependent tracking bugs for affected Red Hat products (Red Hat Bugzilla). The FreeRDP project maintainer (akallabeth) published the security advisory (GHSA-945c-qq5h-jqwp) and credited the reporter programmervuln for discovering and reporting the issue (FreeRDP Advisory). No significant broader media coverage or notable social media discussion has been observed at this time.