Medium severity · published Aug 1, 2026
CVE-2026-67302
FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecam_dev_process_start_streams_request() parses a server-controlled CAM_MEDIA_TYPE_DESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not FrameRateDenominator. When a malicious or compromised RDP server sends a StartStreamsRequest with FrameRateDenominator set to zero, ecam_encoder_context_init() (channels/rdpecam/client/encoding.c) computes FrameRateNumerator / FrameRateDenominator, causing an integer division by zero (SIGFPE) and termination of the FreeRDP client process. Camera redirection must be enabled on the client for the channel to be reachable. Fixed in FreeRDP 3.29.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
FreeRDP · FreeRDP
before 3.29.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-67302
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-67302
Patch
https://github.com/FreeRDP/FreeRDP/commit/1cc783d4c78bd2f66d3a8582dfe70a663d141444
Patch
https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f
Exploit
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v89x-pc32-hqr7
Patch
https://www.vulncheck.com/advisories/freerdp-rdpecam-startstreamsrequest-divide-by-zero-denial-of-service
More from FreeRDP
9.8
CVE-2026-63633
FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client
9.8
CVE-2026-55194
FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch
9.8
CVE-2026-55191
FreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocation
9.8
CVE-2026-66402
FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass
9.8
CVE-2026-57156
FreeRDP: Integer overflow leading to heap buffer overflow in Orders Delta Points parsing