CVE-2026-57157 Details
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, FreeRDP server implementations with the MS-RDPECAM camera device enumerator channel enabled scan attacker-supplied DeviceName and VirtualChannelName fields for a NUL terminator in channels/rdpecam/server/camera_device_enumerator_main.c and then dereference once past the scan bound, allowing a malicious RDP client to trigger a 1- to 2-byte out-of-bounds heap read. This issue is fixed in version 3.28.0.
A vulnerability allowing for an out-of-bounds heap read has been identified in FreeRDP versions prior to 3.28.0. This issue arises in server implementations with the MS-RDPECAM camera device enumerator channel enabled. The vulnerability is triggered by an attacker-supplied DeviceName or VirtualChannelName that lacks a proper NUL terminator. The server-side handler scans the name fields for a terminator but fails to validate the entire length, leading to a 1- to 2-byte out-of-bounds read. This read can access memory beyond the allocated heap, potentially causing a denial-of-service by crashing the server process.
Users can update to FreeRDP version 3.28.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freerdp freerdp | < 3.28.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | Initial Analysis | [email protected] |
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |