AEGLIX vulnerability intelligence
CVE-2026-111374
MEDIUM · CVSS 6.0 · Analyzed
Published: 2026-10-16 · Updated: 2026-10-20 · Source: NVD
Vulnerability overview
FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a StartStreamsRequest with oversized dimensions to force large pending-sample allocations and reconfigure the local camera through the HAL.
Severity and scoring
- CVSS score
- 6.0 · MEDIUM
- CVSS version
- 4.0
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Weaknesses
- CWE-20
CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.
Known exploitation and remediation
Not listed in the CISA catalog retrieved for this record. This does not establish that exploitation has not occurred.
Verify affected versions and patch availability in the vendor advisory before making changes.
Affected products and versions
cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
From (inclusive): 3.30.0
Before (exclusive): 3.32.0
These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.
Advisories and references
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xq87-9rrm-6wqw
Exploit · Mitigation · Vendor Advisory
- https://www.vulncheck.com/advisories/freerdp-from-3.30.0-before-3.32.0-resource-exhaustion-via-rdpecam-startstreamsrequest
Third Party Advisory
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xq87-9rrm-6wqw
Exploit · Mitigation · Vendor Advisory