CVE-2026-66401

lowCVSS 2.1covered by 1 sourcefirst seen 2026-08-01

FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fails to validate descriptor length before accessing the GUID field. A local attacker with a malicious USB video camera can trigger a heap read beyond allocated bounds during camera stream setup, causing denial of service.

⚡ Watch CVE-2026-66401

Get an email if CVE-2026-66401 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

lowCVE-2026-66401: FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 exten…nvd · 2026-08-01

External references

NVD record for CVE-2026-66401

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-66401 status](https://www.csirts.com/badge/CVE-2026-66401)](https://www.csirts.com/cve/CVE-2026-66401)