CVE-2026-57157: FreeRDP Use-After-Free Vulnerability

CVE-2026-57157 Overview

CVE-2026-57157 affects FreeRDP, a widely used open-source implementation of the Remote Desktop Protocol (RDP). The vulnerability resides in the MS-RDPECAM camera device enumerator server channel. FreeRDP server builds prior to version 3.28.0 scan attacker-supplied DeviceName and VirtualChannelName fields for a NUL terminator, then dereference one byte past the scan boundary. A malicious RDP client connected to a vulnerable FreeRDP server can trigger a 1- to 2-byte out-of-bounds heap read, resulting in information disclosure or a process crash. The flaw is tracked as [CWE-125: Out-of-Bounds Read].

Critical Impact
A network-reachable malicious RDP client can force a FreeRDP server with the MS-RDPECAM channel enabled to read past a heap buffer, potentially disclosing adjacent memory or crashing the service.

Affected Products

FreeRDP server implementations prior to 3.28.0
Applications embedding FreeRDP with the MS-RDPECAM camera device enumerator channel enabled
Any downstream distribution packaging FreeRDP versions earlier than 3.28.0

Discovery Timeline

2026-07-10 - CVE-2026-57157 published to the National Vulnerability Database
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57157

Vulnerability Analysis

The defect lives in channels/rdpecam/server/camera_device_enumerator_main.c, which handles MS-RDPECAM device notification PDUs. When parsing CAM_DEVICE_ADDED_NOTIFICATION and CAM_DEVICE_REMOVED_NOTIFICATION messages, the server treats the client-supplied DeviceName and VirtualChannelName as NUL-terminated ANSI strings. The scan loop iterates from an offset of +1 up to the remaining stream length. When the terminator is absent, the loop advances the pointer one byte past the last valid byte and, on the next iteration, dereferences *tmp, producing a 1- to 2-byte read outside the receive buffer.

Because the parser runs on the server side of the RDP session and the enumerator channel is reachable early in the session, no authentication is required to reach the vulnerable code path on servers that expose the camera channel. The impact is limited to reading small amounts of adjacent heap memory or causing a service crash, which aligns with the confidentiality and availability impact reflected in the assigned score.

Root Cause

The root cause is an off-by-one boundary error in the NUL-terminator scan. The loop uses remaining_length as its upper bound but dereferences tmp before rechecking whether bytes remain in the stream. When the attacker omits the terminator, the final iteration reads past the end of the allocated buffer.

Attack Vector

An attacker connects as an RDP client to a FreeRDP-based server that has the MS-RDPECAM channel enabled. The client sends a crafted CAM_DEVICE_ADDED_NOTIFICATION or CAM_DEVICE_REMOVED_NOTIFICATION PDU containing a DeviceName or VirtualChannelName field that is not NUL-terminated within the declared length. Parsing the PDU triggers the out-of-bounds heap read.

// Patched parser for CAM_DEVICE_REMOVED_NOTIFICATION
// channels/rdpecam/server/camera_device_enumerator_main.c
CAM_DEVICE_REMOVED_NOTIFICATION pdu = { .Header = *header,
                                        .VirtualChannelName = Stream_PointerAs(s, char) };

/* VirtualChannelName: Read until either no bytes left or a ANSI '\0' was found */
bool ansiNull = false;
while (Stream_GetRemainingLength(s) >= sizeof(CHAR))
{
    const CHAR c = Stream_Get_INT8(s);
    if (c == '\0')
    {
        ansiNull = true;
        break;
    }
}

Source: FreeRDP commit bd789a31. The fix replaces the pointer-advance loop with a bounded Stream_Get_INT8 read that checks Stream_GetRemainingLength on every iteration, eliminating the trailing dereference.

Detection Methods for CVE-2026-57157

Indicators of Compromise

Unexpected FreeRDP server crashes or aborts shortly after new RDP client connections that negotiate the MS-RDPECAM (RDPECAM) dynamic virtual channel.
RDP sessions in which the client transmits CAM_DEVICE_ADDED_NOTIFICATION or CAM_DEVICE_REMOVED_NOTIFICATION PDUs containing non-NUL-terminated DeviceName or VirtualChannelName fields.
Repeated short-lived RDP sessions from a single source that consistently target servers built against FreeRDP versions earlier than 3.28.0.

Detection Strategies

Inventory hosts running FreeRDP-based server components and identify builds earlier than 3.28.0 with the rdpecam channel compiled in.
Inspect RDP dynamic virtual channel traffic for malformed MS-RDPECAM notifications, focusing on device name fields that lack a terminating null byte.
Enable AddressSanitizer or heap-guard builds in test environments to surface out-of-bounds reads in camera_device_enumerator_main.c during fuzzing.

Monitoring Recommendations

Alert on abnormal termination of FreeRDP server processes, particularly SIGSEGV or heap corruption reports referencing rdpecam symbols.
Log RDP session establishment events and correlate client IPs with sessions that request the camera redirection channel.
Track network flows to RDP listeners from untrusted networks and rate-limit or block repeated malformed connection attempts.

How to Mitigate CVE-2026-57157

Immediate Actions Required

Upgrade all FreeRDP server components to version 3.28.0 or later, which contains the fixes from pull requests #12930 and #12945.
Rebuild and redeploy any application that statically links or vendors FreeRDP once the updated library is available.
Restrict exposure of FreeRDP-based RDP servers to trusted networks until the patch is applied.

Patch Information

The issue is fixed in FreeRDP 3.28.0. The relevant commits are 02991e7b for the device-added path and bd789a31 for the device-removed path. See the GitHub Security Advisory GHSA-47fr-jw86-c3fj and the FreeRDP 3.28.0 release notes for full details.

Workarounds

Disable the MS-RDPECAM camera device enumerator channel at build or runtime for FreeRDP server deployments that do not require camera redirection.
Place FreeRDP servers behind an authenticating gateway or VPN to prevent untrusted clients from reaching the vulnerable channel.
Apply network-layer filtering to allow RDP connections only from known, trusted client addresses until the upgrade is deployed.

bash

# Build FreeRDP with the rdpecam server channel disabled as a temporary workaround
cmake -B build -S . \
  -DWITH_SERVER=ON \
  -DCHANNEL_RDPECAM=OFF \
  -DCHANNEL_RDPECAM_SERVER=OFF
cmake --build build --parallel