CVE-2026-111374: FreeRDP rdpecam Client DoS Vulnerability

CVE-2026-111374 Overview

CVE-2026-111374 is a resource exhaustion vulnerability in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). The flaw resides in the rdpecam camera redirection client and affects versions from 3.30.0 before 3.32.0. A malicious RDP server can request unadvertised camera media types and send a StartStreamsRequest with oversized dimensions. This forces the client to allocate large pending-sample buffers and reconfigure the local camera through the Hardware Abstraction Layer (HAL). The weakness is categorized as improper input validation [CWE-20].

Critical Impact

A hostile RDP server can exhaust memory on connecting clients and manipulate local camera configuration, degrading availability of the client host and attached peripherals.

Affected Products

• FreeRDP 3.30.0
• FreeRDP versions after 3.30.0 and before 3.32.0
• Downstream distributions and applications bundling vulnerable FreeRDP builds

Discovery Timeline

• 2026-10-16 - CVE-2026-111374 published to NVD
• 2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-111374

Vulnerability Analysis

FreeRDP implements the rdpecam channel to redirect local camera devices to a remote RDP session. The client advertises supported media types during channel negotiation. The vulnerability stems from the client accepting server-driven stream parameters without validating them against the advertised capability set. A malicious server can request media formats the client never advertised and specify arbitrary frame dimensions. The client honors those parameters and sizes its pending-sample allocations accordingly. It also reconfigures the attached camera via the HAL to match the server-supplied format. This grants the server influence over local hardware state and over the memory footprint of the client process.

Root Cause

The root cause is missing input validation in the handling of StartStreamsRequest messages. The client trusts both the media type field and the width/height dimensions sent by the server. There is no cross-check against the previously advertised stream descriptors, and no upper bound is enforced on the resulting allocation size.

Attack Vector

Exploitation requires a victim to initiate an RDP connection with camera redirection enabled to an attacker-controlled server. The attacker then returns a crafted StartStreamsRequest with an unadvertised media type and oversized dimensions. The result is excessive memory consumption on the client and unauthorized reconfiguration of the local camera through the HAL.

// No verified public proof-of-concept is available.
// See the FreeRDP GHSA-xq87-9rrm-6wqw advisory for technical specifics.

Detection Methods for CVE-2026-111374

Indicators of Compromise

• Unexpected spikes in resident memory for processes hosting the FreeRDP rdpecam client during active RDP sessions.
• Local camera devices entering unusual resolution or format states shortly after an outbound RDP session begins.
• RDP sessions terminating with out-of-memory errors on the client host.

Detection Strategies

• Inventory endpoints running FreeRDP versions 3.30.0 through 3.31.x and flag them as vulnerable to CVE-2026-111374.
• Monitor outbound RDP connections to untrusted or newly observed servers, particularly when camera redirection is enabled.
• Correlate camera device state changes with the presence of an active FreeRDP process to surface server-driven HAL reconfiguration.

Monitoring Recommendations

• Alert on sustained high memory usage by freerdp, xfreerdp3, or wlfreerdp3 binaries during RDP sessions.
• Log and review rdpecam channel negotiations for mismatches between advertised and requested media types where instrumentation permits.
• Baseline normal camera resolution profiles per host and alert on deviations initiated during RDP activity.

How to Mitigate CVE-2026-111374

Immediate Actions Required

• Upgrade FreeRDP to version 3.32.0 or later on all affected clients.
• Disable camera redirection in RDP client configurations where it is not operationally required.
• Restrict outbound RDP connections to trusted, known-good servers using network policy.

Patch Information

The FreeRDP maintainers addressed the issue in version 3.32.0. Full details are documented in the FreeRDP GitHub Security Advisory GHSA-xq87-9rrm-6wqw and the VulnCheck Resource Exhaustion Advisory. Downstream distributions should pull the fixed release and rebuild dependent packages.

Workarounds

• Launch FreeRDP clients without the /camera redirection flag until patching is complete.
• Block RDP egress to untrusted destinations at the perimeter firewall or via host-based policy.
• Run FreeRDP clients with resource limits that cap maximum per-process memory to contain exhaustion attempts.

# Example: launch xfreerdp without camera redirection and with a memory limit
ulimit -v 2097152 && xfreerdp3 /v:rdp.example.com /u:user