VULNERABILITY INTELLIGENCE

CVE-2026-66401

CVSS score2.4 LOW
EPSS probability0.20%
CISA KEVNot currently listed
Published2026-08-01
Last modified2026-09-03
CVSS vectorCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Description

FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fails to validate descriptor length before accessing the GUID field. A local attacker with a malicious USB video camera can trigger a heap read beyond allocated bounds during camera stream setup, causing denial of service.

Weakness classification

  • CWE-125: Out-of-bounds Read

Primary references