FreeRDP up to 3.28.9 UVC H.264 extension-unit parser out-of-bounds

Summaryinfo

A vulnerability was found in FreeRDP up to 3.28.9. It has been rated as problematic. The affected element is an unknown function of the component UVC H.264 extension-unit parser. The manipulation leads to out-of-bounds. This vulnerability is traded as CVE-2026-66401. An attack has to be approached locally. There is no exploit available.

Detailsinfo

A vulnerability was found in FreeRDP up to 3.28.9 and classified as problematic. This issue affects an unknown function of the component UVC H.264 extension-unit parser. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fails to validate descriptor length before accessing the GUID field. A local attacker with a malicious USB video camera can trigger a heap read beyond allocated bounds during camera stream setup, causing denial of service.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-66401 since 07/26/2026. The exploitation is known to be easy. Attacking locally is a requirement. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 331633 (Linux Distros Unpatched Vulnerability : CVE-2026-66401), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.29.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (331633) and EUVD (EUVD-2026-51831). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Remote Access Software

Name

• FreeRDP

Version

• 3.28.0
• 3.28.1
• 3.28.2
• 3.28.3
• 3.28.4
• 3.28.5
• 3.28.6
• 3.28.7
• 3.28.8
• 3.28.9

License

• open-source

Website

• Product: https://github.com/FreeRDP/FreeRDP/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion