Live › vulnerability › CVE-2026-111375
Go to dashboardFreeRDP's Windows RAIL client reads past the end of a heap buffer when a malicious RDP server sends a window title that is not NUL-terminated. A hostile server can corrupt window titles or crash the client.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| freerdp | vendor | >= 3.0.0, < 3.32.0 | 3.32.0 |
Run xfreerdp /version or check the FreeRDP version installed on Windows clients; affected if between 3.0.0 and 3.31.x.
Upgrade FreeRDP to 3.32.0 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOW_ORDER_FIELD_TITLE update that wf_rail_window_common passes to SetWindowTextW, corrupting titles or crashing the client.
This page as .md · .json · in your agent: get_signal("CVE-2026-111375")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.