CVE-2026-111379
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt
CVSS
7.3
High
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 16, 2026 · Last modified: Oct 16, 2026 · CWE-122
Not enough EPSS history yet.
FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer and potentially execute code.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-111458——
———The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool.6hCVE-2026-1113817.3 HIG—
———FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes mismatched entry size accounting and fixed 16 KiB reads, leading to crashes or code execution when loaded.9hCVE-2026-1084518.8 HIG—
———Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.9hCVE-2026-1084508.8 HIG—
———Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.9hCVE-2026-1084498.8 HIG—
———Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.9hCVE-2026-1084487.5 HIG—
———Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.9h