What’s Vulnerable › Vulnerabilities

CVE-2026-67302: FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-08-01 · updated 2026-09-08
• Weakness: CWE-369

Description

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecam_dev_process_start_streams_request() parses a server-controlled CAM_MEDIA_TYPE_DESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not FrameRateDenominator. When a malicious or compromised RDP server sends a StartStreamsRequest with FrameRateDenominator set to zero, ecam_encoder_context_init() (channels/rdpecam/client/encoding.c) computes FrameRateNumerator / FrameRateDenominator, causing an integer division by zero (SIGFPE) and termination of the FreeRDP client process. Camera redirection must be enabled on the client for the channel to be reachable. Fixed in FreeRDP 3.29.0.

Affected products

• FreeRDP: before 3.29.0 — fixed in 3.29.0

How to fix

Upgrade to a fixed version: FreeRDP 3.29.0. Check the vendor advisory for mitigations.

References

• https://github.com/FreeRDP/FreeRDP/commit/1cc783d4c78bd2f66d3a8582dfe70a663d141444
• https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v89x-pc32-hqr7
• https://www.vulncheck.com/advisories/freerdp-rdpecam-startstreamsrequest-divide-by-zero-denial-of-service
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v89x-pc32-hqr7

Get alerted when CVE-2026-67302 or the next vulnerability affects your stack