Vulnerability in Freerdp
CVE-2026-67302
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecam_dev_process_start_streams_request() parses a server-controlled CAM_MEDIA_TYPE_DESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not FrameRateDenominator. When a malicious or compromised RDP server sends a StartStreamsRequest with FrameRateDenominator set to zero, ecam_encoder_context_init() (channels/rdpecam/client/encoding.c) computes FrameRateNumerator / FrameRateDenominator, causing an integer division by zero (SIGFPE) and termination of the FreeRDP client process. Camera redirection must be enabled on the client for the channel to be reachable. Fixed in FreeRDP 3.29.0.
EPSS: 0.004 (29.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L.
Affected products
- Freerdp — versions 0, 3.29.0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (Exploit, vendor-advisory, Vendor Advisory)
- disclosure@vulncheck.com (Patch, patch)
- disclosure@vulncheck.com (Patch, patch)
- disclosure@vulncheck.com (Patch, Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2026-67302?
- CVE-2026-67302 is a medium-severity vulnerability in Freerdp, classified under Divide By Zero. CVSS score: 4.3/10. Published 2026-08-01.
- How severe is CVE-2026-67302?
- Medium severity. CVSS v3 base score is 4.3 out of 10.