CVE-2026-66401 FreeRDP CVE debrief

Who should care

System administrators and users of FreeRDP versions before 3.29.0 should be aware of this vulnerability and take necessary precautions to prevent exploitation. This includes verifying FreeRDP versions on local systems, applying patches or updates as available, and monitoring for unusual USB device activity. Security teams and vulnerability management teams should prioritize this vulnerability based on its potential impact and the availability of mitigations.

Technical summary

FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser. A local attacker with a malicious USB video camera can trigger a heap read beyond allocated bounds during camera stream setup, causing denial of service. This vulnerability affects FreeRDP versions prior to 3.29.0 and can be mitigated by applying patches or updates as available. The vulnerability is triggered by a failure to validate descriptor length before accessing the GUID field in the UVC H.264 extension-unit parser. Affected systems should be inventoried and verified for exposure. Additional monitoring and logging may be necessary to detect potential exploitation attempts.

Defensive priority

Low-priority defensive actions recommended due to local attack vector and low CVSS score.

Recommended defensive actions

• Inventory and verify FreeRDP versions on local systems
• Apply patches or updates to FreeRDP as available
• Monitor for unusual USB device activity
• Restrict access to USB devices
• Implement additional logging and monitoring for denial-of-service conditions

Evidence notes

Evidence from official CVE and NVD sources indicates an out-of-bounds heap read vulnerability in FreeRDP before 3.29.0. Local attackers with malicious USB video cameras can trigger denial-of-service conditions. Further review of the official CVE record and NVD details is recommended to understand the full scope of this vulnerability. Affected systems should be inventoried and verified for exposure. Additional monitoring and logging may be necessary to detect potential exploitation attempts.

Official resources