CVE-2026-67302

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecam_dev_process_start_streams_request() parses a server-controlled CAM_MEDIA_TYPE_DESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not FrameRateDenominator. When a malicious or compromised RDP server sends a StartStreamsRequest with FrameRateDenominator set to zero, ecam_encoder_context_init() (channels/rdpecam/client/encoding.c) computes FrameRateNumerator / FrameRateDenominator, causing an integer division by zero (SIGFPE) and termination of the FreeRDP client process. Camera redirection must be enabled on the client for the channel to be reachable. Fixed in FreeRDP 3.29.0.

• CWE-369

• https://github.com/FreeRDP/FreeRDP/commit/1cc783d4c78bd2f66d3a8582dfe70a663d141444
• https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v89x-pc32-hqr7
• https://www.vulncheck.com/advisories/freerdp-rdpecam-startstreamsrequest-divide-by-zero-denial-of-service
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v89x-pc32-hqr7

Published

Aug 1, 2026

Last Modified

Aug 3, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-67296FreeRDP before 3.29.0 contains a denial of service vulnerabi…8.7
• CVE-2026-67297FreeRDP before 3.29.0 fails to enforce the RESPONSE_SIZE_LIM…8.7
• CVE-2026-67298FreeRDP versions 3.28.0 and earlier contain a heap buffer ov…8.7
• CVE-2026-67299FreeRDP before 3.29.0 contains a client-side heap use-after-…8.7
• CVE-2026-67300FreeRDP before 3.29.0 contains client-side heap use-after-fr…8.7
• CVE-2026-67301FreeRDP before 3.29.0 contains out-of-bounds read vulnerabil…8.7
• CVE-2026-67303FreeRDP before 3.29.0 contains a reachable assertion (WINPR_…5.3
• CVE-2026-67304FreeRDP before 3.29.0 contains a null pointer dereference vu…8.7
• CVE-2026-67305FreeRDP Windows client before 3.29.0 contains a heap buffer …9.4
• CVE-2026-67306FreeRDP versions 3.28.0 and earlier contain an out-of-bounds…5.4
• CVE-2026-67307Wazuh 5.0.0-beta1 (fixed in 5.0.0-beta3) does not validate o…7
• CVE-2026-67308Wazuh workflows before 44bf114 contain a shell injection vul…9.3