Bug 2509981 (CVE-2026-67302) - CVE-2026-67302 FreeRDP: FreeRDP: Denial of service in camera redirection due to divide-by-zero
Summary: CVE-2026-67302 FreeRDP: FreeRDP: Denial of service in camera redirection due ...
Keywords:
Status: NEW
Alias: CVE-2026-67302
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2510300 2510301
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-01 13:01 UTC by OSIDB Bzimport
Modified: 2026-08-03 07:26 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-01 13:01:35 UTC 
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecam_dev_process_start_streams_request() parses a server-controlled CAM_MEDIA_TYPE_DESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not FrameRateDenominator. When a malicious or compromised RDP server sends a StartStreamsRequest with FrameRateDenominator set to zero, ecam_encoder_context_init() (channels/rdpecam/client/encoding.c) computes FrameRateNumerator / FrameRateDenominator, causing an integer division by zero (SIGFPE) and termination of the FreeRDP client process. Camera redirection must be enabled on the client for the channel to be reachable. Fixed in FreeRDP 3.29.0.
Note You need to log in before you can comment on or make changes to this bug.