CVE-2026-67302

MEDIUM

FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service

Title source: cna
STIX 2.1

Description

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecam_dev_process_start_streams_request() parses a server-controlled CAM_MEDIA_TYPE_DESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not FrameRateDenominator. When a malicious or compromised RDP server sends a StartStreamsRequest with FrameRateDenominator set to zero, ecam_encoder_context_init() (channels/rdpecam/client/encoding.c) computes FrameRateNumerator / FrameRateDenominator, causing an integer division by zero (SIGFPE) and termination of the FreeRDP client process. Camera redirection must be enabled on the client for the channel to be reachable. Fixed in FreeRDP 3.29.0.

References (4)

Core 4
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-v89x-pc32-hqr7)
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v89x-pc32-hqr7
Third Party Advisory third-party-advisory
VulnCheck Advisory: FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service
https://www.vulncheck.com/advisories/freerdp-rdpecam-startstreamsrequest-divide-by-zero-denial-of-service

Scores

CVSS v3 4.3
EPSS 0.0032
EPSS Percentile 24.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-369
Status published
Products (2)
FreeRDP/FreeRDP < 3.29.0
FreeRDP/FreeRDP 3.29.0
Published Aug 01, 2026
Tracked Since Aug 01, 2026