CyberRota Analysis
AI-GeneratedFreeRDP versions up to 3.28.0 are vulnerable to a divide-by-zero vulnerability in the camera redirection client, which can lead to a process termination when a malicious RDP server sends a specially crafted StartStreamsRequest. This issue arises due to insufficient validation of the FrameRateDenominator parameter, allowing an attacker to exploit the vulnerability and crash the FreeRDP client. Organizations using FreeRDP with camera redirection enabled should prioritize upgrading to version 3.29.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecam_dev_process_start_streams_request() parses a server-controlled CAM_MEDIA_TYPE_DESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not FrameRateDenominator. When a malicious or compromised RDP server sends a StartStreamsRequest with FrameRateDenominator set to zero, ecam_encoder_context_init() (channels/rdpecam/client/encoding.c) computes FrameRateNumerator / FrameRateDenominator, causing an integer division by zero (SIGFPE) and termination of the FreeRDP client process. Camera redirection must be enabled on the client for the channel to be reachable. Fixed in FreeRDP 3.29.0.