CVE-2026-67302
Received Received - Intake

Divide-by-Zero in FreeRDP Camera Redirection

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecam_dev_process_start_streams_request() parses a server-controlled CAM_MEDIA_TYPE_DESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not FrameRateDenominator. When a malicious or compromised RDP server sends a StartStreamsRequest with FrameRateDenominator set to zero, ecam_encoder_context_init() (channels/rdpecam/client/encoding.c) computes FrameRateNumerator / FrameRateDenominator, causing an integer division by zero (SIGFPE) and termination of the FreeRDP client process. Camera redirection must be enabled on the client for the channel to be reachable. Fixed in FreeRDP 3.29.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-67302
EUVD
EUVD-2026-51834

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freerdp freerdp to 3.29.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-369 The product divides a value by zero.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeRDP before version 3.29.0 has a divide-by-zero vulnerability in its camera redirection feature. When a malicious RDP server sends a specific request with a zero FrameRateDenominator value, it causes an integer division by zero in the client, leading to a crash (SIGFPE). This only affects systems where camera redirection is enabled.

Detection Guidance

Detecting this vulnerability requires checking the FreeRDP version and monitoring for crashes during camera redirection. Use 'xfreerdp --version' to check if your version is below 3.29.0. Monitor system logs for SIGFPE errors during RDP sessions with camera redirection enabled.

Impact Analysis

If you use FreeRDP with camera redirection enabled and connect to a malicious or compromised RDP server, the client may crash unexpectedly. This could disrupt remote desktop sessions but does not allow code execution or data theft.

Mitigation Strategies

Upgrade FreeRDP to version 3.29.0 or later immediately. Disable camera redirection in RDP client settings if not required. If upgrading is not possible, restrict RDP server access to trusted networks only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67302. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart