CVE-2026-111374: FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequest

Q: Who is exposed to this issue?

FreeRDP rdpecam clients running versions from 3.30.0 before 3.32.0 are exposed when they connect to a malicious RDP server.

Q: What must an attacker do to trigger the resource exhaustion?

The attacker must operate or control an RDP server and send a StartStreamsRequest that requests unadvertised camera media types with oversized dimensions. This causes large pending-sample allocations and camera reconfiguration through the local HAL.

Q: What is the practical impact?

The reported impact is resource exhaustion, resulting in an availability impact on the affected client. The supplied vector indicates network reachability, low privileges, no user interaction, high attack complexity, and no confidentiality or integrity impact.

Published Oct 16, 2026

Updated

FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a StartStreamsRequest with oversized dimensions to force large pending-sample allocations and reconfigure the local camera through the HAL.

Affected Software

1 affected component

FreeRDP freerdp>=3.30.0<3.32.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.32.0

Event History

Oct 16, 2026

CVE Published

via MITRE·01:17 AM

Data Sourced

via MITRE·01:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

FreeRDP rdpecam clients running versions from 3.30.0 before 3.32.0 are exposed when they connect to a malicious RDP server.

What must an attacker do to trigger the resource exhaustion?

The attacker must operate or control an RDP server and send a StartStreamsRequest that requests unadvertised camera media types with oversized dimensions. This causes large pending-sample allocations and camera reconfiguration through the local HAL.

What is the practical impact?

The reported impact is resource exhaustion, resulting in an availability impact on the affected client. The supplied vector indicates network reachability, low privileges, no user interaction, high attack complexity, and no confidentiality or integrity impact.

CVE-2026-111374: FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequest

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to trigger the resource exhaustion?

What is the practical impact?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to trigger the resource exhaustion?

What is the practical impact?