Resource Exhaustion Vulnerability in FreeRDP by FreeRDP
CVE-2026-111374

6MEDIUM

Key Information:

Vendor

Freerdp

Status
Freerdp
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111374?

FreeRDP versions prior to 3.32.0 are susceptible to a resource exhaustion vulnerability present in the rdpecam client. This issue allows malicious RDP servers to issue requests for unsupported camera media types. By sending a StartStreamsRequest with excessively large dimensions, attackers can instigate large allocations of pending samples, potentially disrupting local camera configurations through the Hardware Abstraction Layer (HAL). Users are advised to update to the latest version to mitigate this risk.

Affected Version(s)

FreeRDP 3.30.0 < 3.32.0

FreeRDP 3.32.0

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/freerdp-from-3.30.0-...
third-party-advisory

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kushalkhemka
mayank-jangid-moon
skigeek16
opensec-intelligence
.