CVE-2026-67302: FreeRDP Camera Redirection DoS Vulnerability

CVE-2026-67302 Overview

CVE-2026-67302 is a divide-by-zero vulnerability in FreeRDP's rdpecam camera redirection channel. Versions of FreeRDP up to and including 3.28.0 are affected. The flaw resides in ecam_dev_process_start_streams_request(), which parses a server-controlled CAM_MEDIA_TYPE_DESCRIPTION structure from a StartStreamsRequest PDU. The function validates only the Format and Flags fields, leaving FrameRateDenominator unchecked. A malicious or compromised Remote Desktop Protocol (RDP) server can set FrameRateDenominator to zero, causing ecam_encoder_context_init() in channels/rdpecam/client/encoding.c to trigger a SIGFPE and terminate the FreeRDP client process. The issue is tracked under [CWE-369] and fixed in FreeRDP 3.29.0.

Critical Impact
A hostile RDP server can crash any FreeRDP client that has camera redirection enabled, producing a client-side denial-of-service condition.

Affected Products

FreeRDP versions <= 3.28.0
FreeRDP client builds with camera redirection (rdpecam) enabled
Downstream distributions and applications embedding vulnerable FreeRDP builds

Discovery Timeline

2026-08-01 - CVE-2026-67302 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67302

Vulnerability Analysis

The rdpecam channel implements client-side camera redirection over RDP. When the server issues a StartStreamsRequest PDU, the client parses one or more CAM_MEDIA_TYPE_DESCRIPTION entries describing the requested media stream. Field validation in ecam_dev_process_start_streams_request() checks the Format and Flags values but does not enforce constraints on FrameRateNumerator or FrameRateDenominator. The parsed structure is passed to ecam_encoder_context_init(), which computes an effective frame rate using integer division. Because the denominator is attacker-controlled and unvalidated, a value of zero triggers a hardware floating-point exception (SIGFPE) and the FreeRDP client process terminates. The result is a reliable denial of service against any client that has connected to a malicious server with camera redirection enabled.

Root Cause

The root cause is missing input validation on server-supplied PDU fields, categorized as [CWE-369] Divide By Zero. The vulnerable code in channels/rdpecam/client/encoding.c performs FrameRateNumerator / FrameRateDenominator without a guard clause ensuring the denominator is non-zero. Trust boundaries are crossed silently because the client treats the server-controlled CAM_MEDIA_TYPE_DESCRIPTION as validated data.

Attack Vector

Exploitation requires the victim to connect to an attacker-controlled RDP server with camera redirection enabled on the client. Once the RDP session is established and the camera dynamic virtual channel is negotiated, the malicious server sends a crafted StartStreamsRequest PDU containing a CAM_MEDIA_TYPE_DESCRIPTION with FrameRateDenominator = 0. The client parses the PDU, invokes ecam_encoder_context_init(), and crashes on the division. No memory corruption, code execution, or data exposure is required; the impact is limited to availability of the client process.

See the GitHub Security Advisory GHSA-v89x-pc32-hqr7 and the Vulncheck FreeRDP Advisory for further technical detail. No public proof-of-concept exploit code is currently listed for this CVE.

Detection Methods for CVE-2026-67302

Indicators of Compromise

Unexpected termination of FreeRDP client processes (xfreerdp, wlfreerdp, or embedded clients) with SIGFPE (signal 8) exit status shortly after establishing an RDP session.
Core dumps whose backtrace includes ecam_encoder_context_init or ecam_dev_process_start_streams_request frames.
RDP dynamic virtual channel traffic on the RDCAMERA_DEVICE channel immediately preceding client crash events.

Detection Strategies

Inspect RDP dynamic virtual channel traffic for StartStreamsRequest PDUs where the parsed FrameRateDenominator field equals zero.
Correlate outbound RDP connections to untrusted destinations with subsequent abnormal FreeRDP process exits on the originating host.
Alert on FreeRDP client versions at or below 3.28.0 discovered through software inventory scans.

Monitoring Recommendations

Enable core dump collection on endpoints running FreeRDP so post-crash forensics can confirm the SIGFPE origin.
Log all outbound TCP/3389 and TCP/443 RDP sessions initiated by users, including destination reputation.
Monitor package inventory for FreeRDP builds compiled with the WITH_CHANNEL_RDPECAM option prior to 3.29.0.

How to Mitigate CVE-2026-67302

Immediate Actions Required

Upgrade FreeRDP to version 3.29.0 or later on all client endpoints and rebuild any downstream applications that statically link FreeRDP.
Restrict outbound RDP connections from managed endpoints to a vetted list of known-good servers to reduce exposure to hostile RDP endpoints.
Disable camera redirection in FreeRDP client invocations until patched builds are deployed.

Patch Information

The vulnerability is fixed in FreeRDP 3.29.0. Upstream commits are available at the FreeRDP commit 1cc783d4 and FreeRDP commit 5370fb26. Administrators using distribution-provided FreeRDP packages should track backported fixes from their vendor for the 3.x branch.

Workarounds

Launch FreeRDP without the /camera or /video redirection flags so the rdpecam channel is not negotiated.
Build FreeRDP with the -DCHANNEL_RDPECAM=OFF CMake option to remove the vulnerable channel entirely.
Enforce network segmentation policies that block outbound RDP to untrusted networks and Internet destinations.

bash

# Configuration example: launch FreeRDP without camera redirection
xfreerdp /v:rdp.example.internal /u:analyst -camera -video

# Or rebuild FreeRDP with the rdpecam channel disabled
cmake -B build -S . -DCHANNEL_RDPECAM=OFF
cmake --build build