FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, FreeRDP server implementations with the MS-RDPECAM camera device enumerator channel enabled scan attacker-supplied DeviceName and VirtualChannelName fields for a NUL terminator in channels/rdpecam/server/camera_device_enumerator_main.c and then dereference once past the scan bound, allowing a malicious RDP client to trigger a 1- to 2-byte out-of-bounds heap read. This issue is fixed in version 3.28.0.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade freerdp | Jul 15, 2026 | Jul 10, 2026 |
| Amazon Linux Ami 2 | — | Upgrade libwinpr-develUpgrade freerdpUpgrade freerdp-develUpgrade freerdp-debuginfoUpgrade libwinprUpgrade freerdp-libs | Aug 5, 2026 | Aug 5, 2026 |
| Amazon_linux_2023 | — | Upgrade freerdpUpgrade libwinprUpgrade freerdp-server-debuginfoUpgrade libwinpr-develUpgrade freerdp-debugsourceUpgrade freerdp-libs-debuginfoUpgrade freerdp-develUpgrade freerdp-libsUpgrade freerdp-serverUpgrade freerdp-debuginfoUpgrade libwinpr-debuginfo | Aug 10, 2026 | Jul 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Jul 10, 2026 |
| Ubuntu | — | Upgrade freerdp3-x11Upgrade libfreerdp3-3Upgrade freerdp-x11 | Jul 21, 2026 | Jul 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub