Junglewise Threat Intelligence

CVE-2026-57157: FreeRDP out-of-bounds read in MS-RDPECAM camera enumerator

CVE-2026-57157 · Severity: medium · CVSS 6.5 · Published 2026-07-10

Technologies: FreeRDP. Vendors: FreeRDP.

Executive brief

FreeRDP is an open-source implementation of the Remote Desktop Protocol used to connect to computers remotely. A security flaw in how the server handles camera device information allows a malicious user to send specially crafted data that triggers an improper memory read. This could lead to minor information disclosure or cause the remote desktop service to crash, impacting availability.

Technical details

An out-of-bounds (OOB) read vulnerability exists in FreeRDP's MS-RDPECAM camera device enumerator channel, specifically within `channels/rdpecam/server/camera_device_enumerator_main.c`. The server fails to properly bound-check the `DeviceName` and `VirtualChannelName` fields when scanning for a NUL terminator. If a malicious client sends a name that reaches the end of the PDU without a NUL terminator, the code dereferences a pointer one to two bytes past the allocated heap buffer. This can be exploited by an unauthenticated remote attacker to trigger a 1- to 2-byte OOB read, potentially leading to a denial-of-service (crash) or limited information leakage. The issue is resolved in version 3.28.0 by ensuring the scan remains within the buffer bounds.

Affected products

  • FreeRDP FreeRDP < 3.28.0

Timeline

  • 2026-06-19: other: Initial fix for device added notification parsing merged
  • 2026-06-22: other: Fix for device removed PDU parsing merged
  • 2026-07-06: patched: Version 3.28.0 released
  • 2026-07-10: disclosed: CVE-2026-57157 published

References

Related threats