CVE-2026-66401: FreeRDP UVC H.264 DoS Vulnerability

CVE-2026-66401 Overview

CVE-2026-66401 is an out-of-bounds heap read vulnerability in FreeRDP versions before 3.29.0. The flaw resides in the USB Video Class (UVC) H.264 extension-unit parser, which fails to validate descriptor length before accessing the GUID field. A local attacker who can attach a malicious USB video camera to a system running FreeRDP can trigger a heap read beyond allocated bounds during camera stream setup. The result is a denial of service condition affecting the FreeRDP client process. The vulnerability is classified under CWE-125 (Out-of-bounds Read) and requires physical access plus user interaction to redirect the USB device.

Critical Impact
A crafted USB video device can cause FreeRDP to read past a heap buffer, terminating the client session and disrupting remote desktop connectivity.

Affected Products

FreeRDP versions prior to 3.29.0
FreeRDP clients with UVC (USB Video Class) redirection enabled
Applications and distributions bundling vulnerable FreeRDP libraries

Discovery Timeline

2026-08-01 - CVE-2026-66401 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-66401

Vulnerability Analysis

The vulnerability affects FreeRDP's handling of UVC extension-unit descriptors during USB device redirection. When a UVC H.264 extension unit is parsed, the code accesses the GUID field within the descriptor structure without first confirming that the descriptor length is sufficient to contain that field. If a malicious or malformed USB device presents a truncated descriptor, the parser reads bytes beyond the allocated heap buffer.

The read is bounded to a small region beyond the buffer, so integrity and confidentiality impact is minimal. Availability, however, is affected because the resulting memory access can trigger process termination through allocator sanity checks or memory protection faults. Camera stream setup fails and the FreeRDP session is disrupted.

Root Cause

The parser trusts device-supplied length metadata implicitly. It performs pointer arithmetic to reach the GUID field of the H.264 extension descriptor without verifying that descriptor->bLength is greater than or equal to the offset plus the GUID size. This is a classic missing bounds check pattern documented in CWE-125.

Attack Vector

Exploitation requires physical proximity. An attacker must connect a specially crafted USB video device, or emulate one via a programmable USB peripheral, to a host running a vulnerable FreeRDP client with UVC redirection active. The user must accept or have preconfigured redirection of the USB device. Once the device is enumerated and stream setup begins, FreeRDP parses the malformed extension unit and reads out of bounds.

The fix, published in commit 5044d53, adds length validation prior to accessing the GUID field. Refer to the GitHub Security Advisory GHSA-8jj2-67pg-j6mg and the VulnCheck Advisory on FreeRDP for additional technical detail.

Detection Methods for CVE-2026-66401

Indicators of Compromise

Unexpected FreeRDP client crashes or session terminations occurring shortly after USB video device connection
Kernel or userspace logs showing SIGSEGV, heap corruption, or AddressSanitizer reports from freerdp or wfreerdp processes
USB device enumeration events for unfamiliar UVC devices on endpoints running FreeRDP

Detection Strategies

Inventory FreeRDP installations and identify versions below 3.29.0 across managed endpoints
Monitor process crash telemetry for the FreeRDP client binary and correlate with recent USB attach events
Review UVC descriptor traffic in USB packet captures for descriptors with abnormally small bLength values relative to declared extension unit type

Monitoring Recommendations

Enable USB device auditing via Windows Event ID 6416 or Linux udev logs to record camera attachments
Alert on repeated FreeRDP process terminations from the same host within short intervals
Track the presence of vulnerable FreeRDP binaries through software inventory scans

How to Mitigate CVE-2026-66401

Immediate Actions Required

Upgrade FreeRDP to version 3.29.0 or later on all managed endpoints and build pipelines
Rebuild and redeploy any downstream applications that statically link or bundle FreeRDP libraries
Restrict USB device redirection policies to trusted devices only where feasible

Patch Information

The fix is included in FreeRDP 3.29.0. The upstream commit 5044d53 introduces validation of the UVC descriptor length prior to GUID access. Distribution maintainers should backport the patch to supported LTS branches. Consult the GitHub Security Advisory GHSA-8jj2-67pg-j6mg for release notes.

Workarounds

Disable UVC (camera) redirection in FreeRDP client configurations until the patch is applied
Enforce USB device allowlisting through endpoint management to block unknown video devices
Physically restrict access to USB ports on systems that run FreeRDP in sensitive environments

bash

# Disable USB camera redirection when launching the FreeRDP client
xfreerdp /v:remote.host.example /u:user \
  -usb:auto,dev:VideoClass