CVE-2026-111374

A flaw was found in FreeRDP. This vulnerability allows a malicious Remote Desktop Protocol (RDP) server to cause a Denial of Service (DoS) on a connecting client. When camera redirection is enabled, an attacker-controlled server can send stream requests with unadvertised or excessively large dimensions without proper client-side validation. This causes the client to allocate excessive memory buffers and reconfigure the local camera, leading to resource exhaustion.

This vulnerability is rated as having a Moderate impact because exploitation requires a client to initiate a connection to an untrusted or compromised RDP server with camera redirection explicitly enabled, limiting the blast radius to client-side resource exhaustion without compromising system confidentiality or integrity. Under default configurations, camera redirection is not active, significantly minimizing exposure on typical installations. Even if triggered, the excessive memory allocation affects only the local client process and camera subsystem rather than enabling unauthorized code execution or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Camera redirection is not enabled by default in FreeRDP; the vulnerable rdpecam code path is only active when a client connects to an RDP server with camera redirection enabled. As a mitigation, avoid enabling camera redirection when connecting to untrusted or potentially compromised RDP servers. For deployments that require camera redirection, no workaround is available other than upgrading to a FreeRDP version containing the fix.