CVE-2026-111381

A flaw was found in FreeRDP. This flaw allows arbitrary code execution or a Denial of Service (DoS) when parsing persistent cache files. A local attacker can trigger this vulnerability by tricking a user into loading a maliciously crafted cache file containing oversized image dimensions. This manipulation leads to an integer calculation error and a heap-based buffer overflow, causing memory corruption.

A heap-based buffer overflow was found in FreeRDP's persistent cache v2 parser (persistent_cache_read_entry_v2 in libfreerdp/cache/persistent.c). An integer wraparound in the bitmap size calculation allows a crafted persistent cache v2 file containing oversized width and height values to bypass bounds checks, causing mismatched entry size accounting and fixed 16 KiB reads that corrupt heap memory. A local attacker can exploit this flaw by convincing a user to load a maliciously crafted persistent cache file, resulting in a crash of the FreeRDP client or potential arbitrary code execution in the context of the user running the client. Red Hat rates this flaw as IMPORTANT (CVSS 7.3, CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), consistent with the upstream Important rating, with exploitation requiring user interaction to load the attacker-supplied cache file. The freerdp package as shipped in Red Hat Enterprise Linux 7, 8, 9, and 10, freerdp and freerdp2 in Red Hat In-Vehicle OS, and freerdp and freerdp2 in Fedora and EPEL are affected, and fixes for these products are being pursued.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.