What is CVE-2026-111379?

CVE-2026-111379 is a high-severity vulnerability in Freerdp, classified under Heap-based Buffer Overflow. CVSS score: 7.3/10. Published 2026-10-16.

How severe is CVE-2026-111379?

High severity. CVSS v3 base score is 7.3 out of 10.

Buffer overflow in Freerdp

CVE-2026-111379

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer and potentially execute code.

Vulnerability class: Buffer Overflow

Published 2026-10-16 · last modified 2026-10-16.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Freerdp

Weakness classification (CWE)

CWE-122 — Heap-based Buffer Overflow

References

github.com/FreeRDP/FreeRDP/security/advisories/GHSA-945c-qq5h-jqwp (vendor-advisory)
www.vulncheck.com/advisories/freerdp-before-3.32.0-heap-buffer-overflow-via-per… (third-party-advisory)
134c704f-9b21-4f2e-91b3-4a467353bcc0

Frequently asked questions

What is CVE-2026-111379?: CVE-2026-111379 is a high-severity vulnerability in Freerdp, classified under Heap-based Buffer Overflow. CVSS score: 7.3/10. Published 2026-10-16.
How severe is CVE-2026-111379?: High severity. CVSS v3 base score is 7.3 out of 10.