CVE-2026-111375 FreeRDP CVE debrief

Who should care

Defenders responsible for systems using FreeRDP, especially those exposed to untrusted RDP servers, should assess and mitigate this vulnerability. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-111375 is a MEDIUM-severity vulnerability in FreeRDP that could lead to client crashes or information disclosure if exploited. Defenders should prioritize patching and restrict RDP access to trusted servers.

• Potential client crashes or instability
• Possible information disclosure through heap over-reads
• Requires patching or mitigation to prevent exploitation
• Exploitation requires malicious RDP server access

Technical summary

FreeRDP versions from 3.0.0 before 3.32.0 contain an out-of-bounds read vulnerability in the Windows RAIL client. Malicious RDP servers can trigger heap over-reads by sending non-NUL-terminated window titles, potentially corrupting titles or crashing the client. This vulnerability, tracked by CVE-2026-111375, was publicly disclosed on October 16, 2026, and defenders should prioritize patching or mitigating this vulnerability, especially for systems exposed to untrusted RDP servers. Affected deployments should be identified and owners assigned for follow-up.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially for systems exposed to untrusted RDP servers.

Recommended defensive actions

• Patch FreeRDP to version 3.32.0 or later
• Restrict RDP access to trusted servers
• Monitor for suspicious RDP activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. Additional information comes from source references, including a GitHub advisory and a Vulncheck advisory. Defenders should verify FreeRDP versions, assess exposure, and review vendor guidance for patching or mitigation. Evidence limits suggest focusing on confirmed affected versions and potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.