CVE-2026-67303

FreeRDP before 3.29.0 Denial of Service via serial DeviceControl

Published Aug 1, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

FreeRDP before 3.29.0 contains a reachable assertion (WINPR_ASSERT(OutputBufferLength == BytesReturned)) in serial_process_irp_device_control() in channels/serial/client/serial_main.c. When serial device redirection is enabled and a server-controlled IRP_MJ_DEVICE_CONTROL request specifies an unsupported IOCTL with a non-zero OutputBufferLength, CommDeviceIoControl() can fail with BytesReturned = 0, causing the mismatch to trigger the assertion and abort the client process (denial of service).

Analysis

Technical impact

FreeRDP versions before 3.29.0 contain a reachable assertion in the serial device handling code that triggers when a server sends an unsupported IOCTL request with an incorrect output buffer length. The assertion compares the expected output length to the actual return value; a mismatch causes the client to abort and terminate, resulting in a denial of service. The weakness is a flawed assumption shown by CWE-617, leading to client crash when invalid data is processed.

Affected Systems

The affected product is FreeRDP, a remote desktop protocol client. All releases prior to 3.29.0 are vulnerable when serial device redirection is enabled. No other vendors or product versions are listed.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no public exploit is known. The likely attack vector is from a remote RDP server that can send a crafted device control request to a FreeRDP client with serial redirection enabled; this inference is based on the description of the trigger conditions.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

FreeRDP

unaffected

Version	Status	Constraints
`0`	affected	< 3.29.0
`3.29.0`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Freerdp

Version	Status	Scheme	Platform
`[0,3.29.0)`	affected	semver	—
`3.29.0`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to FreeRDP 3.29.0 or later, which removes the faulty assertion
If an upgrade is not possible, disable serial device redirection on the client or server to prevent the triggering request from being processed
Employ monitoring for abrupt client terminations and apply vendor patches or code changes as available

Generated by OpenCVE AI on August 2, 2026 at 02:56 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.418% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/FreeRDP/FreeRDP/commit/1cc783d4c78bd2f66d3a8582dfe70a663d141444
https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pfxq-3qmw-8vjx
https://nvd.nist.gov/vuln/detail/CVE-2026-67303
https://www.cve.org/CVERecord?id=CVE-2026-67303
https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-serial-devicecontrol

History

Aug 7, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-67303 https://www.cve.org/CVERecord?id=CVE-2026-67303
Metrics	threat_severity `None`	threat_severity `Moderate`

Aug 3, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 1, 2026 12:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		FreeRDP before 3.29.0 contains a reachable assertion (WINPR_ASSERT(OutputBufferLength == BytesReturned)) in serial_process_irp_device_control() in channels/serial/client/serial_main.c. When serial device redirection is enabled and a server-controlled IRP_MJ_DEVICE_CONTROL request specifies an unsupported IOCTL with a non-zero OutputBufferLength, CommDeviceIoControl() can fail with BytesReturned = 0, causing the mismatch to trigger the assertion and abort the client process (denial of service).
Title		FreeRDP before 3.29.0 Denial of Service via serial DeviceControl
First Time appeared		Freerdp Freerdp freerdp
Weaknesses		CWE-617
CPEs		cpe:2.3:a:freerdp:freerdp::::::::
Vendors & Products		Freerdp Freerdp freerdp
References		https://github.com/FreeRDP/FreeRDP/commit/1cc783d4c78bd2f66d3a8582dfe70a663d141444 https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pfxq-3qmw-8vjx https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-serial-devicecontrol
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`