CVE-2026-66401

FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264

Published Aug 1, 2026 CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed

Description

FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fails to validate descriptor length before accessing the GUID field. A local attacker with a malicious USB video camera can trigger a heap read beyond allocated bounds during camera stream setup, causing denial of service.

Analysis

Technical impact

FreeRDP before version 3.29.0 contains a heap read vulnerability in the UVC H.264 extension-unit parser. The parser fails to validate the descriptor length before accessing the GUID field, allowing a local attacker who controls a malicious USB video camera to trigger a read beyond the allocated buffer during camera stream setup. The resulting out‑of‑bounds heap read can cause the FreeRDP client to crash, leading to a denial of service. The weakness is identified as CWE‑125.

Affected Systems

The affected product is FreeRDP. All installations of FreeRDP with a version earlier than 3.29.0 are impacted. Upgrading to 3.29.0 or later removes the vulnerability.

Risk and Exploitability

The CVSS score is 2.4, indicating a low‑severity flaw. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires local access to the target and a malicious USB video camera. Because the attack is local, the likelihood is limited to environments where users can plug in USB devices, but any successful exploit will lead to a crash of the FreeRDP client, denying remote desktop functionality.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

FreeRDP

unaffected

Version	Status	Constraints
`0`	affected	< 3.29.0
`3.29.0`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Freerdp

Version	Status	Scheme	Platform
`[0,3.29.0)`	affected	generic	—
`3.29.0`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest FreeRDP release (3.29.0 or newer) which removes the out‑of‑bounds read.
If an immediate update is not possible, physically disconnect or block the use of USB video cameras to prevent the attacker from supplying a malicious device.
Temporarily disable UVC H.264 support in the FreeRDP configuration to stop the vulnerable parser from being invoked.

Generated by OpenCVE AI on August 2, 2026 at 03:05 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.201% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/FreeRDP/FreeRDP/commit/5044d5390035c6fd9a36ad885192d97d21e8a92d
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8jj2-67pg-j6mg
https://nvd.nist.gov/vuln/detail/CVE-2026-66401
https://www.cve.org/CVERecord?id=CVE-2026-66401
https://www.vulncheck.com/advisories/freerdp-before-out-of-bounds-read-via-uvc-h-264

History

Aug 3, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 3, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-66401 https://www.cve.org/CVERecord?id=CVE-2026-66401
Metrics	threat_severity `None`	threat_severity `Low`

Aug 1, 2026 12:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fails to validate descriptor length before accessing the GUID field. A local attacker with a malicious USB video camera can trigger a heap read beyond allocated bounds during camera stream setup, causing denial of service.
Title		FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264
First Time appeared		Freerdp Freerdp freerdp
Weaknesses		CWE-125
CPEs		cpe:2.3:a:freerdp:freerdp::::::::
Vendors & Products		Freerdp Freerdp freerdp
References		https://github.com/FreeRDP/FreeRDP/commit/5044d5390035c6fd9a36ad885192d97d21e8a92d https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8jj2-67pg-j6mg https://www.vulncheck.com/advisories/freerdp-before-out-of-bounds-read-via-uvc-h-264
Metrics		cvssV3_1 `{'score': 2.1, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}` cvssV4_0 `{'score': 2.4, 'vector': 'CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`