FreeRDP’s RDPECAM camera enumerator channel scans the DeviceName and VirtualChannelName fields supplied by an RDP client looking for a NUL terminator, then dereferences beyond the first missing terminator, producing a 1‑to‑2‑byte out‑of‑bounds read on the heap. This flaw, classified as CWE‑125, can leak otherwise protected data residing on the server heap. The read does not trigger code execution, denial of service, or privilege escalation, but any data present adjacent to the memory buffer could be disclosed.

All FreeRDP server deployments running a version prior to 3.28.0 with the MS‑RDPECAM camera device enumerator channel enabled. Versions 3.28.0 and newer have the patch that removes the vulnerable code path. If a system cannot be immediately updated, the enumerator channel can be disabled to fully remove the risk.

The CVSS score of 6.5 reflects the moderate confidentiality impact of a small data leak. The EPSS score of < 1 % indicates that this exploit is expected to occur rarely, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to initiate an RDP session and send a specially crafted request containing an unterminated DeviceName or VirtualChannelName to the enumerator channel. The vector is remote and requires remote RDP access, so the risk is higher in environments where RDP traffic is not tightly restricted; in highly secured or firewall‑protected RDP deployments the likelihood of successful exploitation remains low.