PatchSiren cyber security CVE debrief
CVE-2026-57157 FreeRDP CVE debrief
FreeRDP server implementations with the MS-RDPECAM camera device enumerator channel enabled are vulnerable to a heap read issue. This issue allows a malicious RDP client to trigger a 1- to 2-byte out-of-bounds heap read. The vulnerability is fixed in version 3.28.0. Users of FreeRDP server implementations with the MS-RDPECAM camera device enumerator channel enabled should review and apply the provided patches. The CVE record was published on 2026-07-10T20:16:48.387Z and has not been modified since then.
- Vendor
- FreeRDP
- Product
- Unknown
- CVSS
- MEDIUM 6.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-10
- Original CVE updated
- 2026-07-10
- Advisory published
- 2026-07-10
- Advisory updated
- 2026-07-10
Who should care
Users of FreeRDP server implementations with the MS-RDPECAM camera device enumerator channel enabled should review and apply the provided patches. This includes administrators and security teams responsible for managing and securing FreeRDP deployments. Additionally, operators and platform administrators may need to review the vulnerability and take necessary actions to mitigate the risk.
Technical summary
Prior to version 3.28.0, FreeRDP server implementations with the MS-RDPECAM camera device enumerator channel enabled scan attacker-supplied DeviceName and VirtualChannelName fields for a NUL terminator in channels/rdpecam/server/camera_device_enumerator_main.c and then dereference once past the scan bound, allowing a malicious RDP client to trigger a 1- to 2-byte out-of-bounds heap read. This issue is fixed in version 3.28.0. The vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity.
Defensive priority
Medium priority due to the CVSS score of 6.5 and the availability of patches.
Recommended defensive actions
- Review and apply the provided patches to update FreeRDP to version 3.28.0 or later.
- Disable the MS-RDPECAM camera device enumerator channel if not required.
- Monitor for and restrict malicious RDP client activity.
- Review compensating controls for exposed systems while remediation is scheduled and verified.
- Check relevant monitoring, detection, and logs for exposed assets that need extra review.
- Track exceptions, retest remediated assets, and close the item only after evidence is documented.
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
Evidence notes
The CVE record was published on 2026-07-10T20:16:48.387Z and has not been modified since then. The NVD entry is currently 6.5 MEDIUM. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity. The CVE-2026-57157 debrief has been generated based on the supplied source corpus, which may have limitations. Users should review the official advisory or CVE record for more details.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-10T20:16:48.387Z and has not been modified since then.