Log in Start free

Vulnerability · Published Aug 1, 2026 · Assigned by VulnCheck

CVE-2026-67302FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service

Medium 4.3

In plain English

A medium-severity security flaw in FreeRDP from FreeRDP. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.5%top 57.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecam_dev_process_start_streams_request() parses a server-controlled CAM_MEDIA_TYPE_DESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not FrameRateDenominator. When a malicious or compromised RDP server sends a StartStreamsRequest with FrameRateDenominator set to zero, ecam_encoder_context_init() (channels/rdpecam/client/encoding.c) computes FrameRateNumerator / FrameRateDenominator, causing an integer division by zero (SIGFPE) and termination of the FreeRDP client process. Camera redirection must be enabled on the client for the channel to be reachable. Fixed in FreeRDP 3.29.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12freerdp2no fix listedDEBIAN-CVE-2026-67302
Debian:13freerdp3no fix listedDEBIAN-CVE-2026-67302
Debian:14freerdp33.29.0+dfsg-1DEBIAN-CVE-2026-67302
Ubuntu:22.04:LTSfreerdp2no fix listedUBUNTU-CVE-2026-67302
Ubuntu:24.04:LTSfreerdp33.30.0+dfsg-0ubuntu0.24.04.1UBUNTU-CVE-2026-67302
Ubuntu:26.04:LTSfreerdp33.30.0+dfsg-0ubuntu0.26.04.1UBUNTU-CVE-2026-67302

Affected products (as reported)

VendorProductVersions
FreeRDP FreeRDP 0 – before 3.29.0

Weakness: CWE-369 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

References