Is CVE-2026-111379 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111379 being exploited in the wild.

How severe is CVE-2026-111379?

High severity, with a CVSS score of 7.3, published 16 October 2026.

Which products and versions are affected?

FreeRDP Project FreeRDP before 3.32.0.

Is there a fix for CVE-2026-111379?

Yes: fixed in 3.32.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-111379 attacked?

It is attacked with local access.

Am I affected by CVE-2026-111379?

Check whether you run FreeRDP Project FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111379: FreeRDP heap buffer overflow in persistent cache parser

CVE-2026-111379 · Severity: high · CVSS 7.3 · Published 2026-10-16

FreeRDP is an open-source remote desktop protocol client and server used to access graphical desktop environments across networks. A heap buffer overflow in the persistent cache file parser allows a local attacker to corrupt memory by providing a malicious cache file, potentially achieving arbitrary code execution on the affected system.

Technologies: FreeRDP Project FreeRDP. Vendors: FreeRDP Project.

Quick answers

Is CVE-2026-111379 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111379 being exploited in the wild.
How severe is CVE-2026-111379?: High severity, with a CVSS score of 7.3, published 16 October 2026.
Which products and versions are affected?: FreeRDP Project FreeRDP before 3.32.0.
Is there a fix for CVE-2026-111379?: Yes: fixed in 3.32.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111379 attacked?: It is attacked with local access.
Am I affected by CVE-2026-111379?: Check whether you run FreeRDP Project FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.32.0

Technical details

An integer wraparound vulnerability in persist_cache_get_data calculates a small wrapped size value that passes a UINT32_MAX check, then a heap buffer allocated with this truncated size is written out-of-bounds by fread using the original wrapped size. The vulnerability requires a local attacker to supply a malicious v3 persistent cache file with carefully crafted width and height values (e.g., width=3221225474, height=3) that trigger 64-bit multiplication wraparound.

Affected products

FreeRDP Project FreeRDP before 3.32.0

Timeline

2026-10-01: disclosed: GitHub Security Advisory GHSA-945c-qq5h-jqwp published
2026-10-15: advisory
2026-10-16: other: CVE-2026-111379 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.