CVE-2026-111374
Received Received - Intake

Resource Exhaustion in FreeRDP via Malicious RDP Server

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a StartStreamsRequest with oversized dimensions to force large pending-sample allocations and reconfigure the local camera through the HAL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111374
EUVD
EUVD-2026-102555

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 3.30.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeRDP versions from 3.30.0 to 3.32.0 have a resource exhaustion flaw in the rdpecam client. Malicious RDP servers can exploit this by sending a StartStreamsRequest with oversized dimensions, causing large pending-sample allocations and forcing the local camera to reconfigure through the HAL.

Detection Guidance

To detect this vulnerability, check if FreeRDP versions 3.30.0 to 3.31.1 are installed and if the rdpecam client is enabled. Monitor for unusual camera redirection requests or excessive memory usage during RDP sessions. No specific commands are provided in the context, but inspecting FreeRDP logs and system resource usage may help identify abnormal behavior.

Impact Analysis

This vulnerability could lead to denial of service by exhausting system resources. An attacker could crash the FreeRDP client or disrupt camera functionality on the affected system.

Compliance Impact

This vulnerability primarily causes resource exhaustion leading to denial of service, which may impact system availability. It does not directly affect data confidentiality or integrity but could indirectly impact compliance by disrupting services that handle regulated data under standards like GDPR or HIPAA.

Mitigation Strategies

Update FreeRDP to version 3.32.0 or later to address the resource exhaustion vulnerability in the rdpecam client.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111374. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart