FreeRDP CVE-2026-67302

|

EUVD

EUVD-2026-51834 MEDIUM

Divide By Zero (CWE-369)

2026-08-01 VulnCheck

GHSA-jrm8-x4f5-vff8

Information Disclosure Freerdp

5.3

CVSS 4.0 · Vendor: VulnCheck

Share

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network attack via malicious server; user must connect (UI:R); crash affects only client process (A:L); no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Red Hat

4.3 MEDIUM

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

P

Scope

X

Lifecycle Timeline

2

Source Code Evidence Fetched

Aug 01, 2026 - 13:29 vuln.today

Analysis Generated

Aug 01, 2026 - 13:29 vuln.today

DescriptionCVE.org

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecam_dev_process_start_streams_request() parses a server-controlled CAM_MEDIA_TYPE_DESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not FrameRateDenominator. When a malicious or compromised RDP server sends a StartStreamsRequest with FrameRateDenominator set to zero, ecam_encoder_context_init() (channels/rdpecam/client/encoding.c) computes FrameRateNumerator / FrameRateDenominator, causing an integer division by zero (SIGFPE) and termination of the FreeRDP client process. Camera redirection must be enabled on the client for the channel to be reachable. Fixed in FreeRDP 3.29.0.

AnalysisAI

Divide-by-zero in FreeRDP's rdpecam camera redirection channel allows a malicious or compromised RDP server to crash the connecting client process by sending a StartStreamsRequest PDU with FrameRateDenominator set to zero. All FreeRDP releases up to and including 3.28.0 are affected when camera redirection is enabled; exploitation delivers a reliable client-side denial-of-service (SIGFPE termination) with no code execution potential. No public exploit or CISA KEV listing exists at time of analysis; this is a medium-severity availability issue patched in FreeRDP 3.29.0.

Technical ContextAI

FreeRDP implements the Microsoft RDP Extended Camera Redirection virtual channel (rdpecam) in channels/rdpecam/client/encoding.c. The function ecam_dev_process_start_streams_request() deserializes a CAM_MEDIA_TYPE_DESCRIPTION from a server-supplied StartStreamsRequest PDU. The code validates the Format and Flags fields but omits validation of FrameRateDenominator. When ecam_encoder_context_init() subsequently computes FrameRateNumerator / FrameRateDenominator with a denominator of zero, the C runtime raises SIGFPE (integer divide-by-zero), immediately terminating the process. The root cause is CWE-369 (Divide By Zero) - a missing input-bounds check on a server-controlled integer field. The affected CPE is cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:* covering all versions before 3.29.0. The 'Information Disclosure' tag in the source intelligence appears to be a mis-categorization; the actual impact is exclusively availability (process crash).

RemediationAI

Upgrade FreeRDP to version 3.29.0 or later, which addresses the divide-by-zero by adding FrameRateDenominator validation in ecam_encoder_context_init(). Patch commits are available at https://github.com/FreeRDP/FreeRDP/commit/1cc783d4c78bd2f66d3a8582dfe70a663d141444 and https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f, with the full advisory at https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v89x-pc32-hqr7. Where immediate upgrade is not feasible, disable the rdpecam camera redirection channel on all FreeRDP clients (/rdpecam:off or equivalent build/config flag); this fully eliminates the attack surface at the cost of losing camera pass-through functionality. Organizations that do not require camera redirection should disable it as a permanent hardening measure regardless of patch status. Connecting only to trusted, internally controlled RDP servers is an additional compensating control that limits exposure to the server-side trigger requirement.

More in Freerdp

View all

CVE-2026-25997 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth

CVE-2026-25953 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti

CVE-2026-25952 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor

CVE-2026-25959 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem

CVE-2026-22857 CRITICAL Act Now POC

FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi

CVE-2026-22854 CRITICAL Act Now POC

FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai

CVE-2026-22852 CRITICAL Act Now POC

FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m

CVE-2026-25955 CRITICAL Act Now POC

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and

CVE-2024-32041 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-40574 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

CVE-2023-40569 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

CVE-2023-40567 CRITICAL Act Now POC

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

Same weakness CWE-369 – Divide By Zero

View all

CVE-2017-11720 CRITICAL POC

CVE-2012-0207 HIGH POC

CVE-2017-7598 HIGH POC

CVE-2016-3623 HIGH POC

CVE-2023-3896 HIGH POC

CVE-2023-1127 HIGH POC

CVE-2023-0512 HIGH POC

CVE-2021-29600 HIGH POC

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

CVE-2021-34523 CRITICAL POC

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7	Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7	Not-Affected
SUSE Linux Enterprise Server 15 SP7	Not-Affected

Share

CVE-2026-67302 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy