ZeroDay Findings
Sign inSign up

Findings

CVE-2026-111374

FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequest

Published Oct 16, 2026 · updated Oct 16, 2026 · FreeRDP FreeRDP

FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a StartStreamsRequest with oversized dimensions to force large pending-sample allocations and reconfigure the local camera through the HAL.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 16, 2026 · CIRCL Vulnerability Lookup

    Detected

    FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a StartStreamsRequest with oversized dimensions to force large pending-sample allocations and reconfigure the local camera through the HAL.

  2. Oct 16, 2026 · NIST NVD

    Updated

    FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a StartStreamsRequest with oversized dimensions to force large pending-sample allocations and reconfigure the local camera through the HAL.

Affected

  • vendor FreeRDP FreeRDPversion unspecified

Sources

  • CIRCL Vulnerability LookupVulnerability recordCVE-2026-111374

    FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a StartStreamsRequest with oversized dimensions to force large pending-sample allocatio

    vulnerability.circl.lu
  • CVE.orgVulnerability recordCVE-2026-111374

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-111374

    FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a StartStreamsRequest with oversized dimensions to force large pending-sample allocatio

    nvd.nist.gov

References