CVE-2026-111374 in FreeRDP
Summary
by MITRE • 10/16/2026
FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a StartStreamsRequest with oversized dimensions to force large pending-sample allocations and reconfigure the local camera through the HAL.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The identified security flaw resides within FreeRDP versions 3.30.0 up to, but not including, version 3.32.0, specifically affecting the rdpecam client component responsible for handling remote desktop camera streams. This vulnerability is classified as a resource exhaustion issue that allows malicious Remote Desktop Protocol servers to exploit improper input validation and state management mechanisms within the client application. The core technical deficiency involves the failure to adequately validate media type advertisements and stream parameters before processing them, enabling an attacker to bypass standard negotiation protocols by requesting unadvertised camera media types during session initialization or reconfiguration phases.
From a technical perspective, the exploitation vector centers on the transmission of a StartStreamsRequest containing oversized dimension values for video streams. When the rdpecam client receives this request, it proceeds to allocate memory buffers corresponding to these exaggerated dimensions without sufficient bounds checking against previously negotiated capabilities or hardware limitations. This leads to significant pending-sample allocations that consume excessive amounts of system RAM and processing resources. The allocation process is designed to prepare buffer space for incoming video data, but the lack of validation allows an attacker to trigger a denial-of-service condition by forcing the client into a state where it exhausts available memory reserves or becomes unresponsive due to resource contention.
Beyond simple resource exhaustion, this vulnerability poses additional risks related to system integrity and privacy. The malicious server can leverage the compromised stream configuration to reconfigure the local camera hardware through the Hardware Abstraction Layer. This capability allows an attacker to potentially alter camera settings such as resolution, frame rate, or even access control states without user consent. Such manipulation could facilitate unauthorized surveillance scenarios where the victim is unaware that their webcam has been hijacked for remote monitoring by the malicious RDP server operator.
In terms of industry standard classifications, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption leading to denial-of-service conditions. The mechanism of sending oversized requests to trigger excessive memory allocation also reflects characteristics associated with CWE-789, although the primary impact here is exhaustion rather than arbitrary code execution via buffer overflow in the traditional sense. From a tactical perspective within the MITRE ATT&CK framework, this behavior maps to T1505.003, which covers Server Software Component: Remote Desktop Services, and potentially T1123, Audio Capture, if the camera reconfiguration is used to enable unauthorized audio or video recording capabilities on the target system.
The operational impact of this vulnerability includes service disruption for users relying on FreeRDP for remote desktop sessions involving webcam sharing. Victims may experience application crashes, significant performance degradation due to memory pressure, or complete loss of control over their peripheral devices. For organizations deploying FreeRDP in enterprise environments where secure remote access is critical, the ability of a server-side actor to manipulate client hardware settings represents a severe breach of trust and security boundaries between the host machine and the remote session environment.
Mitigation strategies primarily involve upgrading to FreeRDP version 3.32.0 or later, where these validation checks have been implemented to ensure that stream dimensions are constrained within acceptable limits defined by both the protocol specification and local hardware capabilities. Administrators should also enforce strict network segmentation policies to prevent untrusted RDP servers from initiating connections with webcam-sharing features enabled. Additionally, implementing application whitelisting can help restrict the execution of vulnerable client binaries until patches are fully deployed across all endpoints in the infrastructure.