Skip to main content
Threat Radar animated logo

FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to… (CVE-2026-111375)

0
Medium
VulnerabilityCVE-2026-111375gcveosvubuntu-cve-2026-111375cve-2026-111375ubuntu-16-04-ltsubuntu-pro-18-04-ltsubuntu-18-04-ltsubuntu-pro-20-04-ltsubuntu-22-04-ltsubuntu-24-04-ltsubuntu-pro-24-04-ltsubuntu-26-04-lts
Published: 10/16/2026 (10/16/2026, 00:00:00 UTC)
Source: GCVE Database
Product: freerdp

Description

FreeRDP versions from 3.0.0 up to but not including 3.32.0 contain an out-of-bounds read vulnerability in the Windows RAIL client. This flaw allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles, potentially causing client crashes or corruption of window titles. The vulnerability is identified as CVE-2026-111375 and has a CVSS score of 9.1, indicating high severity. A patch is available to address this issue.

CVSS v3.1

Score 9.1critical

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected software

Ubuntu:16.04:LTSmore threats →ghsa
freerdp
pkg:deb/ubuntu/freerdp?arch=source&distro=xenial
Affected versions
=1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1=1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.2=1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3=1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4
Ubuntu:Pro:18.04:LTSmore threats →ghsa
freerdp2
pkg:deb/ubuntu/freerdp2?arch=source&distro=esm-infra/bionic
Affected versions
=2.0.0~git20170725.1.1648deb+dfsg1-1=2.0.0~git20170725.1.1648deb+dfsg1-5=2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu1=2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu2=2.0.0~git20170725.1.1648deb+dfsg1-6=2.0.0~git20170725.1.1648deb+dfsg1-6build1=2.0.0~git20170725.1.1648deb+dfsg1-7=2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1=2.1.1+dfsg1-0ubuntu0.18.04.1=2.2.0+dfsg1-0ubuntu0.18.04.1=2.2.0+dfsg1-0ubuntu0.18.04.2=2.2.0+dfsg1-0ubuntu0.18.04.3=2.2.0+dfsg1-0ubuntu0.18.04.4=2.2.0+dfsg1-0ubuntu0.18.04.4+esm1=2.2.0+dfsg1-0ubuntu0.18.04.4+esm2=2.2.0+dfsg1-0ubuntu0.18.04.4+esm3=2.2.0+dfsg1-0ubuntu0.18.04.4+esm4=2.2.0+dfsg1-0ubuntu0.18.04.4+esm5=2.2.0+dfsg1-0ubuntu0.18.04.4+esm6
Ubuntu:18.04:LTSmore threats →ghsa
freerdp
pkg:deb/ubuntu/freerdp?arch=source&distro=bionic
Affected versions
=1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1=1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1=1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2
Ubuntu:Pro:20.04:LTSmore threats →ghsa
freerdp2
pkg:deb/ubuntu/freerdp2?arch=source&distro=esm-infra/focal
Affected versions
=2.0.0~git20190204.1.2693389a+dfsg1-1=2.0.0~git20190204.1.2693389a+dfsg1-2=2.0.0~git20190204.1.2693389a+dfsg1-2build1=2.0.0~git20190204.1.2693389a+dfsg1-2build2=2.1.1+dfsg1-0ubuntu0.20.04.1=2.2.0+dfsg1-0ubuntu0.20.04.1=2.2.0+dfsg1-0ubuntu0.20.04.2=2.2.0+dfsg1-0ubuntu0.20.04.3=2.2.0+dfsg1-0ubuntu0.20.04.4=2.2.0+dfsg1-0ubuntu0.20.04.5=2.2.0+dfsg1-0ubuntu0.20.04.6=2.6.1+dfsg1-0ubuntu0.20.04.1=2.6.1+dfsg1-0ubuntu0.20.04.2=2.6.1+dfsg1-0ubuntu0.20.04.2+esm1=2.6.1+dfsg1-0ubuntu0.20.04.2+esm2=2.6.1+dfsg1-0ubuntu0.20.04.2+esm3=2.6.1+dfsg1-0ubuntu0.20.04.2+esm4
Ubuntu:22.04:LTSmore threats →ghsa
freerdp2
pkg:deb/ubuntu/freerdp2?arch=source&distro=jammy
Affected versions
=2.3.0+dfsg1-2build1=2.3.0+dfsg1-2ubuntu1=2.3.0+dfsg1-2ubuntu2=2.4.1+dfsg1-1=2.4.1+dfsg1-1ubuntu1=2.4.1+dfsg1-1ubuntu2=2.5.0+dfsg1-1=2.6.0+dfsg1-1=2.6.1+dfsg1-1=2.6.1+dfsg1-3=2.6.1+dfsg1-3ubuntu1=2.6.1+dfsg1-3ubuntu2=2.6.1+dfsg1-3ubuntu2.1=2.6.1+dfsg1-3ubuntu2.2=2.6.1+dfsg1-3ubuntu2.3=2.6.1+dfsg1-3ubuntu2.4=2.6.1+dfsg1-3ubuntu2.5=2.6.1+dfsg1-3ubuntu2.6=2.6.1+dfsg1-3ubuntu2.7=2.6.1+dfsg1-3ubuntu2.8=2.6.1+dfsg1-3ubuntu2.9=2.6.1+dfsg1-3ubuntu2.10=2.6.1+dfsg1-3ubuntu2.11
Ubuntu:24.04:LTSmore threats →ghsa
freerdp3
pkg:deb/ubuntu/freerdp3?arch=source&distro=noble
Affected versions
<3.32.0+dfsg-0ubuntu0.24.04.1=3.4.0+dfsg1-0ubuntu2=3.4.0+dfsg1-0ubuntu3=3.4.0+dfsg1-0ubuntu4=3.5.0+dfsg1-0ubuntu1=3.5.1+dfsg1-0ubuntu1=3.5.1+dfsg1-0ubuntu1.1=3.5.1+dfsg1-0ubuntu1.2=3.5.1+dfsg1-0ubuntu1.4=3.5.1+dfsg1-0ubuntu1.5=3.5.1+dfsg1-0ubuntu1.6=3.30.0+dfsg-0ubuntu0.24.04.1=3.30.0+dfsg-0ubuntu0.24.04.2=3.31.0+dfsg-0ubuntu0.24.04.1
Ubuntu:Pro:24.04:LTSmore threats →ghsa
freerdp2
pkg:deb/ubuntu/freerdp2?arch=source&distro=esm-apps/noble
Affected versions
=2.10.0+dfsg1-1.1ubuntu1=2.11.2+dfsg1-1=2.11.2+dfsg1-1build1=2.11.2+dfsg1-1build3=2.11.5+dfsg1-1build1=2.11.5+dfsg1-1build2=2.11.5+dfsg1-1ubuntu0.1~esm1=2.11.5+dfsg1-1ubuntu0.1~esm2=2.11.5+dfsg1-1ubuntu0.1~esm3=2.11.5+dfsg1-1ubuntu0.1~esm4=2.11.5+dfsg1-1ubuntu0.1~esm5=2.11.5+dfsg1-1ubuntu0.1~esm6
Ubuntu:26.04:LTSmore threats →ghsa
freerdp3
pkg:deb/ubuntu/freerdp3?arch=source&distro=resolute
Affected versions
<3.32.0+dfsg-0ubuntu0.26.04.1=3.16.0+dfsg-2=3.18.0+dfsg-1ubuntu1=3.19.0+dfsg-1=3.19.1+dfsg-1=3.20.0+dfsg-1=3.20.2+dfsg-1=3.21.0+dfsg-1=3.22.0+dfsg-1=3.24.1+dfsg-1ubuntu1=3.24.2+dfsg-1ubuntu1=3.24.2+dfsg-1ubuntu1.1=3.30.0+dfsg-0ubuntu0.26.04.1=3.30.0+dfsg-0ubuntu0.26.04.2=3.31.0+dfsg-0ubuntu0.26.04.1

Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 10/22/2026, 17:36:27 UTC

Technical Analysis

CVE-2026-111375 is an out-of-bounds read vulnerability in FreeRDP's Windows RAIL client affecting versions from 3.0.0 before 3.32.0. The vulnerability arises when a malicious RDP server sends a full-length WINDOW_ORDER_FIELD_TITLE update with a non-NUL-terminated window title. The function wf_rail_window_common passes this data to SetWindowTextW, leading to heap over-reads that can corrupt window titles or crash the client application. This flaw allows remote attackers controlling an RDP server to disrupt client stability or cause denial of service.

Potential Impact

Successful exploitation of this vulnerability can cause heap over-reads resulting in client crashes or corruption of window titles in the FreeRDP Windows RAIL client. This impacts the availability and integrity of the client application but does not directly affect confidentiality or allow code execution. The CVSS score of 9.1 reflects a high impact on availability and partial impact on confidentiality.

Mitigation Recommendations

A patch is available for this vulnerability. Users should upgrade FreeRDP to version 3.32.0 or later to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Gcve Source
db.gcve.eu
Osv Id
UBUNTU-CVE-2026-111375
Osv Schema Version
1.7.0
Ecosystems
["Ubuntu:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:Pro:24.04:LTS","Ubuntu:26.04:LTS"]
Cvss Version
3.1

Threat ID: 6ada44fe4d27ba8daa6a5ad0

Added to database: 10/22/2026, 17:16:46 UTC

Last enriched: 10/22/2026, 17:36:27 UTC

Last updated: 10/22/2026, 17:36:27 UTC

Views: 2

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses