CVE-2026-66401

A flaw was found in FreeRDP. This out-of-bounds read vulnerability in the Universal Video Class (UVC) H.264 extension-unit parser occurs because the software fails to validate descriptor length before accessing the GUID field. A local attacker, by connecting a specially crafted malicious USB video camera, can trigger a read beyond the allocated memory bounds during camera stream setup. This can lead to a denial of service (DoS), making the application unavailable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.