CVE-2026-66401

FreeRDP before 3.29.0 contains an out-of-bounds heap read (CWE-125) in its parser for the USB Video Class (UVC) H.264 extension unit: the code accesses the extension-unit GUID field without first validating the descriptor's length. A local attacker who plugs in a malicious USB video camera can trigger the out-of-bounds read during camera stream setup, crashing the FreeRDP process and causing a denial of service. The impact is availability-only - CVSS 4.0 rates it 2.4 (low) with no confidentiality or integrity impact - and exploitation requires physical access and a crafted USB camera device. Anyone running an affected FreeRDP version on systems where untrusted users can attach USB peripherals is potentially exposed. There is no evidence of exploitation in the wild: the flaw is not in CISA KEV, EPSS estimates a 0.2% 30-day exploitation probability, and the only public reference is the vendor advisory (GHSA-8jj2-67pg-j6mg).

What to do: Upgrade FreeRDP to 3.29.0 or later. As an interim mitigation, avoid using USB camera (UVC) redirection with untrusted devices and restrict physical access to machines running FreeRDP. Check installed versions via your package manager or 'freerdp --version' and prioritize hosts where local users can plug in peripherals.