CVE-2026-67302 Details
Description
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecam_dev_process_start_streams_request() parses a server-controlled CAM_MEDIA_TYPE_DESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not FrameRateDenominator. When a malicious or compromised RDP server sends a StartStreamsRequest with FrameRateDenominator set to zero, ecam_encoder_context_init() (channels/rdpecam/client/encoding.c) computes FrameRateNumerator / FrameRateDenominator, causing an integer division by zero (SIGFPE) and termination of the FreeRDP client process. Camera redirection must be enabled on the client for the channel to be reachable. Fixed in FreeRDP 3.29.0.
A divide-by-zero vulnerability has been identified in the FreeRDP camera redirection client, specifically in versions through 3.28.0. The issue arises in the 'rdpecam' channel when the 'ecam_dev_process_start_streams_request()' function processes a 'StartStreamsRequest' PDU containing a server-controlled 'CAM_MEDIA_TYPE_DESCRIPTION'. While the parser validates the media format and flags, it fails to check the 'FrameRateDenominator', allowing a malicious RDP server to send a value of zero. This oversight leads to an integer division by zero in the 'ecam_encoder_context_init()' function, causing a SIGFPE error and terminating the FreeRDP client process. To trigger this vulnerability, camera redirection must be enabled on the client, and the malicious server must open the 'rdpecam' dynamic virtual channel.
Users can upgrade to FreeRDP version 3.29.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-369 | Divide By Zero | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| freerdp freerdp | < 3.29.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | Initial Analysis | [email protected] |
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 1, 2026 | New CVE Received | [email protected] |