FreeRDP CVE-2026-111374

Exploitation requires the FreeRDP client to have the rdpecam camera-redirection virtual channel enabled AND to connect to a malicious or compromised RDP server; the attacker (the server) then sends a crafted StartStreamsRequest requesting an unadvertised camera media type with oversized dimensions. Limiting factors: camera redirection is not a default-critical feature for most RDP sessions, the victim must initiate a connection to an untrusted server, attack complexity is high (AC:H/AT:P) because the malformed request must be precisely crafted, and impact is limited to availability (client resource exhaustion) with no code execution or data disclosure. Clients that never enable camera redirection or only connect to trusted servers are not realistically exposed.

This is a moderate-severity denial-of-service issue, not a top-tier priority. The vendor-assigned CVSS 4.0 score is 6.0 (MEDIUM), reflecting a client-side resource-exhaustion flaw with no confidentiality or integrity impact (VC:N/VI:N) and only availability impact confined to the vulnerable system (VA:H, SC:N/SI:N/SA:N). The attack vector is network (AV:N) but tempered by high attack complexity (AC:H) and a present attack requirement (AT:P), meaning exploitation depends on specific non-default conditions - namely the rdpecam camera-redirection channel being active and the FreeRDP client connecting to an attacker-controlled or compromised RDP server. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no indication of active or widespread exploitation. The PR:L in the vendor vector is notable: for a server-attacks-client scenario the 'privilege' better maps to the victim having an established, consented RDP session with camera redirection enabled rather than attacker-held credentials - this is a nuance worth verifying against the GHSA advisory. Net: a real but contained reliability/DoS bug affecting clients that both use camera redirection and connect to untrusted servers, not an urgent remote-code-execution emergency.

A FreeRDP client with camera redirection (rdpecam) enabled connects to a malicious or compromised RDP server. The server responds to the camera channel with a StartStreamsRequest specifying an unadvertised media type and oversized frame dimensions, forcing the client to allocate large pending-sample buffers and reconfigure the local camera through the HAL, exhausting memory and degrading or crashing the client. No public proof-of-concept is currently known, and the high attack complexity means the server must craft the malformed request precisely.