FreeRDP CVE-2026-111381

Exploitation requires the victim to load an attacker-crafted FreeRDP persistent bitmap cache v2 file, so the persistent bitmap caching feature path (persistent_cache_read_entry_v2) must be exercised. The crafted file must contain oversized width and height values that trigger integer wraparound in the bitmap size calculation, producing mismatched entry-size accounting against fixed 16 KiB reads. Limiting factors: the attack vector is LOCAL (AV:L) - the attacker must get the malicious cache file onto the victim's system or into the client's load path - and it depends on user interaction (UI:P), i.e., the victim actively loading the file with a vulnerable FreeRDP build before 3.32.0. The PR:L requirement indicates low-level local privileges are also needed. There is no remote, unauthenticated path.

This is a moderate-priority local vulnerability rather than a mass-exploitation threat. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P, score 7.0) is internally consistent with the description: exploitation is LOCAL, requires some privilege (PR:L), and depends on passive user interaction (UI:P) - namely a victim loading a maliciously crafted persistent cache v2 file. Technical impact is high across confidentiality, integrity, and availability (VC:H/VI:H/VA:H) because heap corruption via integer wraparound can escalate from a crash to arbitrary code execution. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The local attack vector plus required user interaction materially limits real-world risk: this is not a remotely automatable, wormable flaw. The signals do NOT conflict - all point to a serious-but-constrained memory-safety bug whose exploitation hinges on tricking a user into loading attacker-controlled cache data. Priority should be driven by whether FreeRDP-based clients in the environment process untrusted persistent cache files.

An attacker delivers a crafted FreeRDP persistent bitmap cache v2 file (with oversized width/height fields) to a victim and induces them to load it with a vulnerable FreeRDP client (before 3.32.0). The integer wraparound in the bitmap size calculation causes mismatched entry-size accounting and fixed 16 KiB reads, corrupting the heap and resulting in a crash or potential arbitrary code execution in the user's context. No public exploit code is identified at time of analysis, and the local vector plus required user interaction make this an opportunistic/targeted scenario rather than remote mass exploitation.