All vulnerabilities
CVE-2026-111374GHSA-xq87-9rrm-6wqw

FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequest

FreeRDP FreeRDP
Open in ThreatlineRecord JSON
CVSS
6.0Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 16 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 16% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.32.0Fixed versionCVE List
Published16 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a StartStreamsRequest with oversized dimensions to force large pending-sample allocations and reconfigure the local camera through the HAL.

Text from CVE List

Affected versions 2

  • FreeRDPaffected: 3.30.0 before 3.32.0CVE List
  • FreeRDPunaffected: 3.32.0CVE List

References 2