This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-111381 →

DEBIAN-CVE-2026-111381

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memo...

Original description

The description as published by the source.

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes mismatched entry size accounting and fixed 16 KiB reads, leading to crashes or code execution when loaded.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 freerdp2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 freerdp3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 freerdp3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.32.0+dfsg-1"}]}]

References

advisory security-tracker.debian.org