CVE-2026-67302: FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecamdevprocessstartstreamsrequest() parses a server-controlled CAMMEDIATYPEDESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not FrameRateDenominator. When a malicious or compromised RDP server sends a StartStreamsRequest with FrameRateDenominator set to zero, ecamencodercontextinit() (channels/rdpecam/client/encoding.c) computes FrameRateNumerator / FrameRateDenominator, causing an integer division by zero (SIGFPE) and termination of the FreeRDP client process. Camera redirection must be enabled on the client for the channel to be reachable. Fixed in FreeRDP 3.29.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.29.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67302?
The severity of CVE-2026-67302 is classified as medium with a score of 4.3.
How do I fix CVE-2026-67302?
To mitigate CVE-2026-67302, upgrade to FreeRDP version 3.29.0 or later.
What type of vulnerability is CVE-2026-67302?
CVE-2026-67302 is a divide-by-zero vulnerability in the FreeRDP camera redirection client.
What can be exploited in CVE-2026-67302?
CVE-2026-67302 can be exploited via a specially crafted StartStreamsRequest PDU leading to a denial of service.
Which versions of FreeRDP are affected by CVE-2026-67302?
FreeRDP versions 3.28.0 and earlier are affected by CVE-2026-67302.