CVE-2026-111381: 
Wolfi vulnerability analysis and mitigation

CVE-2026-111381 is a heap-based buffer overflow vulnerability in FreeRDP's persistent cache v2 parser (persistent_cache_read_entry_v2) that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. It affects all FreeRDP versions prior to 3.32.0 (up to and including 3.31.1). The vulnerability was published on October 16, 2026, with the patch available in FreeRDP 3.32.0. It carries a CVSS v3.1 score of 7.3 (High) and a CVSS v4.0 score of 7.0 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a 64-bit unsigned integer wraparound (CWE-122, CWE-787) in the persist_cache_get_data helper function, which computes bitmap data size as 4ull * entry->width * entry->height. An attacker-controlled large width and height in a crafted persistent cache v2 file causes this expression to wrap around to a small value, bypassing the if (expected > UINT32_MAX) guard. The allocation via winpr_aligned_recalloc is at least 0x4000 bytes (due to MAX(0x4000, expected)), but entry->size is set to the falsified small wrapped value. Subsequently, persistent_cache_read_entry_v2 unconditionally reads a fixed 0x4000 (16 KiB) bytes from the cache file into entry->data, and the scan-loop function persistent_cache_read_v2 uses a hard-coded fseek(fp, 0x4000, SEEK_CUR) to skip bitmap payloads — together causing file-pointer misalignment, parsing-state corruption, and heap out-of-bounds access. Exploitation requires a local attacker with low privileges to induce a victim user to load a malicious persistent cache v2 file. A PoC repository (programmervuln/freerdp-persistent-cache-v2-heapoverflow) and a PoC generator (gen_poc_v2.c) are referenced in the upstream advisory (FreeRDP Advisory).

Successful exploitation results in heap memory corruption within the FreeRDP client process, leading to application crashes (denial of service) and potentially arbitrary code execution in the context of the victim user running FreeRDP. All three security pillars are affected: confidentiality, integrity, and availability are rated High in both CVSS v3.1 and v4.0 assessments. The scope is limited to the vulnerable system (no subsequent system impact), but code execution could enable further local privilege escalation or data exfiltration depending on the environment (FreeRDP Advisory, GitHub Advisory).

As of the disclosure date, there is no evidence of active in-the-wild exploitation and no confirmed public proof-of-concept exploit code, though the upstream advisory references a PoC repository (programmervuln/freerdp-persistent-cache-v2-heapoverflow) and a PoC generator for reproducing the crash under ASAN. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and user interaction (victim must load a malicious cache file), limiting the attack surface (FreeRDP Advisory, GitHub Advisory).

1. Craft malicious cache file: Using the referenced PoC generator (gen_poc_v2.c from the programmervuln/freerdp-persistent-cache-v2-heapoverflow repository), compile and run the tool to generate a malicious FreeRDP persistent cache v2 file containing oversized width and height field values designed to trigger 64-bit integer wraparound.
2. Deliver the malicious file: Place the crafted cache file in a location accessible to the target user — for example, by replacing or planting it in the FreeRDP persistent cache directory (typically ~/.freerdp/cache/ on Linux), or by social engineering the victim into using a specific cache path.
3. Trigger cache loading: Induce the victim to launch the FreeRDP client configured to use the malicious cache file. FreeRDP will invoke persistent_cache_read_v2, which calls persistent_cache_read_entry_v2 for each cache entry.
4. Trigger integer wraparound: As FreeRDP parses the malicious entry, persist_cache_get_data computes 4ull * width * height, which wraps around to a small value, bypassing the UINT32_MAX guard and setting entry->size to the falsified small value.
5. Trigger heap corruption: The unconditional fread(entry->data, 0x4000, 1, fp) reads 16 KiB into the allocated buffer, and the hard-coded fseek(fp, 0x4000, SEEK_CUR) misaligns the file pointer, corrupting parsing state and causing heap out-of-bounds access.
6. Achieve code execution or crash: Depending on heap layout and exploitation precision, the result is either a crash (DoS) or, with further heap-shaping techniques, potential arbitrary code execution within the FreeRDP client process (FreeRDP Advisory).

• File System: Unexpected or recently modified files in the FreeRDP persistent cache directory (e.g., ~/.freerdp/cache/ on Linux or %APPDATA%\freerdp\cache\ on Windows) with anomalously large width/height metadata or unusual file sizes inconsistent with normal RDP session bitmaps.
• Process: FreeRDP client process (xfreerdp, wfreerdp) crashing unexpectedly or producing ASAN/heap corruption error output; unusual child processes spawned from the FreeRDP process.
• Logs: Application crash logs or core dumps referencing persistent_cache_read_entry_v2 or persist_cache_get_data in the stack trace; ASAN reports indicating heap-buffer-overflow in libfreerdp/cache/persistent.c.
• Network: Unusual file transfers or downloads of .bin or cache-format files to the FreeRDP cache directory from untrusted sources (FreeRDP Advisory).

Upgrade FreeRDP to version 3.32.0 or later, which contains the fix for this vulnerability (GitHub Advisory, FreeRDP Advisory). Until patching is possible, restrict access to FreeRDP persistent cache directories using filesystem permissions, and configure FreeRDP to disable persistent caching (/persistent-cache:off or equivalent) to prevent loading of potentially malicious cache files. Avoid loading persistent cache files from untrusted or shared sources.

Red Hat has filed a tracking bug (Bugzilla #2553917) for this CVE, classifying it as high severity and assigning it to the Product Security DevOps Team for remediation across affected Red Hat products (Red Hat Bugzilla). The original vulnerability was reported by researcher programmervuln and published via the FreeRDP GitHub Security Advisory program (FreeRDP Advisory). No significant broader media coverage or notable social media discussion has been observed at this time.