CVE-2026-111374 FreeRDP CVE debrief

Who should care

Defenders responsible for FreeRDP deployments, particularly those using versions between 3.30.0 and 3.32.0, should assess exposure and prioritize verification and mitigation. This includes reviewing system configurations, restricting access to RDP servers, and monitoring for suspicious activity. Additionally, security teams and vulnerability management teams should be aware of the potential impacts on system performance and availability.

Why it matters

CVE-2026-111374 is a resource exhaustion vulnerability in FreeRDP's rdpecam client. Defenders should prioritize verifying FreeRDP versions and restricting access to RDP servers to prevent potential resource exhaustion and camera reconfiguration.

• Potential resource exhaustion and camera reconfiguration
• Need to verify FreeRDP versions and restrict access to RDP servers
• Possible impact on system performance and availability

Technical summary

The rdpecam client in FreeRDP versions from 3.30.0 before 3.32.0 is vulnerable to a resource exhaustion attack. Malicious RDP servers can request unadvertised camera media types, causing large pending-sample allocations and reconfiguring the local camera through the HAL. This vulnerability can impact system performance and availability, emphasizing the need for defenders to verify FreeRDP versions and restrict access to RDP servers. The vulnerability is a result of inadequate handling of camera media types, allowing attackers to exploit the system.

Defensive priority

Defenders should prioritize verifying FreeRDP versions and restricting access to RDP servers.

Recommended defensive actions

• Verify FreeRDP versions and upgrade to 3.32.0 or later
• Restrict access to RDP servers
• Monitor for suspicious RDP activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Plan vendor-supported updates or mitigations through normal change control

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on exploitation and impact is limited. There is no evidence of public exploitation, but defenders should verify FreeRDP versions and restrict access to RDP servers to prevent potential resource exhaustion and camera reconfiguration. The CVE Program record and NVD detail page offer source-provided CVE metadata and vulnerability assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.