---
id: "CVE-2026-111374"
kind: "vulnerability"
aliases: ["CVE-2026-111374"]
title: "FreeRDP: malicious RDP server exhausts client memory via camera requests"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "freerdp", "fixed": ["3.32.0"], "affected": ">= 3.30.0, < 3.32.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["freerdp", "linux", "other", "remote-desktop", "windows"]
not_affected_if: ["no-camera-redirection", "trusted-servers-only"]
published_at: "2026-10-16T03:18:04+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:05:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111374", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# FreeRDP: malicious RDP server exhausts client memory via camera requests

FreeRDP's rdpecam client, from 3.30.0 before 3.32.0, accepts camera media types that were never advertised and oversized StartStreamsRequest dimensions from an RDP server. A malicious server can force large memory allocations on the client and reconfigure the local camera through the HAL.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:freerdp affected >= 3.30.0, < 3.32.0 fixed 3.32.0

## How to check

- Check the installed FreeRDP version with `xfreerdp --version` or `freerdp --version`, and treat versions from `3.30.0` up to but not including `3.32.0` as exposed.
- Confirm whether camera redirection (rdpecam) is enabled in the client configuration; the sources do not say what the default is.

## Fix

- Upgrade FreeRDP to `3.32.0` or later.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111374

## From the sources

FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a StartStreamsRequest with oversized dimensions to force large pending-sample allocations and reconfigure the local camera through the HAL.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_