EUVD-2026-51831
GHSA-j96g-x36f-4cg4
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Physical access required to attach malicious USB camera; user must initiate stream (UI:R); only low availability impact via crash, no confidentiality or integrity loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fails to validate descriptor length before accessing the GUID field. A local attacker with a malicious USB video camera can trigger a heap read beyond allocated bounds during camera stream setup, causing denial of service.
AnalysisAI
Out-of-bounds heap read in FreeRDP's UVC H.264 extension-unit parser affects all versions prior to 3.29.0, allowing an attacker with physical USB access to trigger denial of service during camera stream setup. The parser fails to validate descriptor length before accessing the GUID field, enabling a read beyond allocated heap bounds when a malicious USB video camera is connected. No public exploit has been identified, KEV listing is absent, and the CVSS 4.0 score of 2.4 accurately reflects the constrained physical-access attack surface.
Technical ContextAI
FreeRDP (cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*) is a widely used open-source implementation of the Remote Desktop Protocol, which includes support for USB device redirection including USB Video Class (UVC) cameras with H.264 hardware encoding via extension units. Extension units are vendor-specific USB descriptor blocks that advertise additional capabilities; the parser reads a GUID field from within such a descriptor. CWE-125 (Out-of-bounds Read) describes the root cause: the code advances to the GUID offset without first verifying the descriptor's reported length field is sufficient to contain it, causing a read past the end of the heap-allocated buffer. This class of bug can produce memory corruption, information disclosure from adjacent heap content, or a process crash depending on allocator behavior and memory layout.
RemediationAI
Upgrade FreeRDP to version 3.29.0 or later, which resolves this vulnerability per the GitHub Security Advisory GHSA-8jj2-67pg-j6mg (https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8jj2-67pg-j6mg); the upstream fix is associated with commit 5044d5390035c6fd9a36ad885192d97d21e8a92d. Where immediate upgrade is not feasible, disabling USB video device class support at the OS level (e.g., blacklisting the uvcvideo kernel module on Linux with 'blacklist uvcvideo' in /etc/modprobe.d/) eliminates the attack surface entirely; this trade-off is that all USB camera functionality, including legitimate use, will be blocked until the module is re-enabled. Physical port controls or USB device allowlisting policies that restrict unknown USB peripherals are a complementary defense. No patch-independent code-level workaround is available.
Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth
Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti
Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor
Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem
FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi
FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai
FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m
Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and
FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today