The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecam_dev_process_start_streams_request() parses a server-controlled CAM_MEDIA_TYPE_DESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not FrameRateDenominator. When a malicious or compromised RDP server sends a StartStreamsRequest with FrameRateDenominator set to zero, ecam_encoder_context_init() (channels/rdpecam/client/encoding.c) computes FrameRateNumerator / FrameRateDenominator, causing an integer division by zero (SIGFPE) and termination of the FreeRDP client process. Camera redirection must be enabled on the client for the channel to be reachable. Fixed in FreeRDP 3.29.0.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade libwinprUpgrade freerdp-server-debuginfoUpgrade freerdp-libsUpgrade freerdp-debuginfoUpgrade freerdp-develUpgrade freerdp-libs-debuginfoUpgrade freerdp-debugsourceUpgrade freerdpUpgrade libwinpr-debuginfoUpgrade libwinpr-develUpgrade freerdp-server | Sep 1, 2026 | Aug 1, 2026 |
| Redhat_linux | — | No solution exists | Aug 4, 2026 | Aug 1, 2026 |
| Ubuntu | — | Upgrade freerdp3 | Aug 17, 2026 | Aug 1, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub