{"id":"CVE-2026-111375","kind":"vulnerability","aliases":["CVE-2026-111375"],"related":[],"title":"FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows…","description":"FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOW_ORDER_FIELD_TITLE update that wf_rail_window_common passes to SetWindowTextW, corrupting titles or crashing the client.","summary":"FreeRDP's Windows RAIL client reads past the end of a heap buffer when a malicious RDP server sends a window title that is not NUL-terminated. A hostile server can corrupt window titles or crash the client.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"freerdp","fixed":["3.32.0"],"affected":">= 3.0.0, < 3.32.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["freerdp","package","rdp-clients","windows"],"not_affected_if":["no-rail-feature","not-windows-client"],"how_to_check":"Run xfreerdp /version or check the FreeRDP version installed on Windows clients; affected if between 3.0.0 and 3.31.x.","fix":"Upgrade FreeRDP to 3.32.0 or later.","status":"open","published_at":"2026-10-16T03:18:04+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-23T22:15:06+00:00","updated_at":"2026-10-23T22:28:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:15:06Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade FreeRDP to 3.32.0 or later.\nunknown","reach":"network","impact":"low","summary":"FreeRDP's Windows RAIL client reads past the end of a heap buffer when a malicious RDP server sends a window title that is not NUL-terminated. A hostile server can corrupt window titles or crash the client.","category":"package","who_cares":["freerdp","windows","rdp-clients"],"confidence":0.6,"needs_auth":"no","worst_case":"Client crashes or window titles are corrupted by a malicious server","analyst_note":"Sources disagree on impact: NVD says critical 9.1 but the description reads as out-of-bounds read causing crash or title corruption. Check the FreeRDP advisory and NVD CVSS vector for code-execution claims.","how_to_check":"Run xfreerdp /version or check the FreeRDP version installed on Windows clients; affected if between 3.0.0 and 3.31.x.\nunknown","needs_analyst":true,"not_affected_if":["no-rail-feature","not-windows-client"],"user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000487,"input_tokens":2814,"output_tokens":411,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-111375':23A,26A '-2026':22A,25A '3.0.0':3A,75C '3.32.0':5A,77C 'allow':20A,92C 'attack':110C 'bound':11A,83C 'buffer':46B 'client':18A,32B,38B,72B,90C,135C 'common':126C 'contain':6A,78C 'corrupt':66B,130C 'crash':70B,133C 'cve':21A,24A 'end':42B 'field':119C 'freerdp':1A,27A,28B,34B,73C 'full':115C 'full-length':114C 'heap':45B,98C 'hostil':63B 'length':116C 'malici':49B,93C 'non':105C 'non-nul-termin':104C 'nul':60B,106C 'nul-termin':59B 'order':118C 'out-of-bound':8A,80C 'over-read':99C 'packag':29B 'pass':127C 'past':40B 'rail':17A,37B,89C,124C 'rdp':31B,50B,94C 'rdp-client':30B 'read':12A,39B,84C,101C 'send':52B,103C,112C 'server':51B,64B,95C 'setwindowtextw':129C 'termin':61B,107C 'titl':55B,68B,109C,120C,131C 'trigger':97C 'updat':121C 'vulner':13A,85C 'wf':123C 'window':16A,33B,36B,54B,67B,88C,108C,117C,125C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T03:18:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111375","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111375","severity":null,"published_at":"2026-10-16T03:18:04+00:00","modified_at":"2026-10-21T02:17:06+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}