FreeRDP has a resource exhaustion vulnerability (CWE-20) in its rdpecam client that allows a malicious RDP server to send a StartStreamsRequest with oversized dimensions for an unadvertised camera media type. This forces the client to allocate large pending‑sample buffers and reconfigure the local camera through the HAL, potentially consuming excessive memory or CPU and resulting in denial of service.

FreeRDP client versions from 3.30.0 up to, but not including, 3.32.0 on all operating systems supported by the project are affected. No other products are listed as vulnerable.

The CVSS score of 6 indicates moderate severity. The EPSS score of 0.00238, or about 0.24%, indicates a very low yet nonzero probability of exploitation, and the issue is not cataloged in the CISA KEV database. The likely attack vector is a malicious RDP server that connects to the FreeRDP client; the attacker must craft a StartStreamsRequest with oversized dimensions to trigger large buffer allocations. Successful exploitation would lead to resource exhaustion, potentially causing the client to become unresponsive or crash, which can be used to disrupt remote sessions.