FreeRDP EUVD-2026-102560

Requires the FreeRDP client (before 3.32.0) to read a crafted v3 persistent bitmap cache file - i.e. the persistent bitmap caching feature must be in use and the malicious cache file must be present on the system and loaded during a session (UI:P / passive interaction). The attacker needs local access with low privileges (PR:L / AV:L) to supply or substitute the cache file; there is no remote or unauthenticated path. Limiting factors that reduce real-world risk: exploitation is local-only, depends on the victim loading the poisoned cache, requires existing low-privilege access, and applies only to FreeRDP versions prior to 3.32.0 using persistent cache v3 files.

The input provides a CVSS 4.0 base score of 7.0 (High) with vector AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H. The signals are internally consistent: this is a LOCAL attack (AV:L), not network-facing, requiring low-level privileges (PR:L) and passive user interaction (UI:P) - i.e. a victim must load/process a session that reads the attacker-supplied persistent bitmap cache file. Technical impact is high across confidentiality, integrity, and availability because a heap overflow can lead to code execution in the FreeRDP client context. No EPSS score, no CISA KEV listing, and no POC indicator were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: this is a legitimate memory-corruption bug with code-execution potential, but the local vector plus the requirement for privileges AND user interaction make it a moderate, not critical, operational priority - it is not remotely or mass-exploitable like network-facing RDP vulnerabilities. Treat as a patch-in-normal-cycle issue unless FreeRDP is used in a context where untrusted cache files can be introduced. Note: EPSS/KEV/POC data is absent (not necessarily zero risk - simply not supplied), so widespread-exploitation likelihood cannot be quantified from available data.

A local, low-privileged attacker plants a maliciously crafted v3 persistent bitmap cache file where a FreeRDP client will read it; when the victim starts or resumes a session that loads the cache, persistent_cache_read_entry_v3 processes attacker-controlled width/height values that wrap the size calculation in persist_cache_get_data, so a subsequent fread overflows an undersized heap buffer. The resulting corruption can crash the client or be leveraged for arbitrary code execution in the user's context. No public exploit was identified at time of analysis, and exploitation is constrained by the low-complexity (AC:L) but local and interaction-dependent nature of the flaw.