CVE-2026-67302 in FreeRDP
Summary
by MITRE • 08/01/2026
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecam_dev_process_start_streams_request() parses a server-controlled CAM_MEDIA_TYPE_DESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not FrameRateDenominator. When a malicious or compromised RDP server sends a StartStreamsRequest with FrameRateDenominator set to zero, ecam_encoder_context_init() (channels/rdpecam/client/encoding.c) computes FrameRateNumerator / FrameRateDenominator, causing an integer division by zero (SIGFPE) and termination of the FreeRDP client process. Camera redirection must be enabled on the client for the channel to be reachable. Fixed in FreeRDP 3.29.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability under discussion represents a critical divide-by-zero error within the FreeRDP implementation that affects versions up to and including 3.28.0. This flaw exists specifically within the rdpecam camera redirection client component, which handles video stream processing for remote desktop connections. The issue stems from insufficient input validation during the parsing of camera media type descriptions received from RDP servers. When a malicious or compromised server sends a specially crafted StartStreamsRequest PDU containing a FrameRateDenominator value of zero, the client application encounters a fatal arithmetic exception that terminates the entire FreeRDP process.
The technical execution of this vulnerability occurs within the ecam_dev_process_start_streams_request() function which processes server-controlled data structures. While the implementation validates the Format and Flags fields of CAM_MEDIA_TYPE_DESCRIPTION, it completely omits validation of the FrameRateDenominator field, creating an exploitable gap in input sanitization. This oversight allows attackers to manipulate the stream configuration parameters without proper boundary checking. The subsequent call to ecam_encoder_context_init() performs a direct division operation between FrameRateNumerator and FrameRateDenominator, resulting in a SIGFPE signal that crashes the client application. This type of error falls under CWE-369, specifically "Division by Zero" in the context of integer arithmetic operations.
The operational impact of this vulnerability extends beyond simple denial-of-service scenarios as it represents a potential attack vector for remote code execution or system compromise through process termination. An attacker who has gained access to an RDP server can leverage this weakness to disrupt legitimate remote desktop sessions, potentially causing service interruption in enterprise environments where FreeRDP clients are used for remote administration. The vulnerability requires that camera redirection be explicitly enabled on the client side, which may limit its exposure but does not eliminate the risk entirely. Attackers could potentially exploit this through social engineering or by compromising RDP servers within the network perimeter.
Mitigation strategies should focus on immediate patch application to FreeRDP version 3.29.0 where the issue has been resolved through proper input validation of all media type description fields including FrameRateDenominator. Organizations should also implement network segmentation and access controls to limit exposure to potentially compromised RDP servers, as well as monitor for anomalous StartStreamsRequest PDU patterns that might indicate exploitation attempts. The fix aligns with ATT&CK technique T1071.004 by addressing protocol manipulation at the application layer, specifically within the remote desktop protocol implementation. Additionally, implementing proper input validation and defensive programming practices including boundary checks and error handling for all arithmetic operations can prevent similar vulnerabilities from emerging in other code components.