CVE-2026-67302

mediumCVSS 4.3covered by 1 sourcefirst seen 2026-08-01

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecam_dev_process_start_streams_request() parses a server-controlled CAM_MEDIA_TYPE_DESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not FrameRateDenominator. When a malicious or compromised RDP server sends a StartStreamsRequest with FrameRateDenominator set to zero, ecam_encoder_context_init() (channels/rdpecam/client/encoding.c) computes FrameRateNumerator / FrameRateDenominator, causing an integer division by zero (SIGFPE) and termination of the FreeRDP client process. Camera redirection must be enabled on the client for the channel to be reachable. Fixed in FreeRDP 3.29.0.

⚡ Watch CVE-2026-67302

Get an email if CVE-2026-67302 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

mediumCVE-2026-67302: FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in…nvd · 2026-08-01

External references

NVD record for CVE-2026-67302

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-67302 status](https://www.csirts.com/badge/CVE-2026-67302)](https://www.csirts.com/cve/CVE-2026-67302)