CVE-2026-67302

FreeRDP versions 3.28.0 and earlier contain an integer divide-by-zero (CWE-369) in the rdpecam camera redirection client, where ecam_dev_process_start_streams_request() parses a server-controlled CAM_MEDIA_TYPE_DESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not FrameRateDenominator. A malicious or compromised RDP server can send a StartStreamsRequest with FrameRateDenominator set to zero, causing ecam_encoder_context_init() (channels/rdpecam/client/encoding.c) to compute FrameRateNumerator / FrameRateDenominator and raise a SIGFPE. The attacker gains a crash and termination of the FreeRDP client process — a denial of service only, with no confidentiality or integrity impact (CVSS 4.0 base 5.3, VA:L only). Only FreeRDP clients running affected 3.x versions with camera redirection enabled are reachable, since the channel must be active for the malformed PDU to be processed. No in-the-wild exploitation is known; a public advisory with a proof-of-concept exists (GHSA-v89x-pc32-hqr7) and EPSS assigns a 0.4% probability of exploitation in the next 30 days.

What to do: Upgrade to FreeRDP 3.29.0 or later. As an interim mitigation, disable the camera redirection (rdpecam) channel on affected clients or restrict connections to trusted RDP servers. Audit whether any deployed 3.x clients have camera redirection enabled, particularly in VDI environments where the feature is typically used.