FreeRDP before 3.29.0 contains a reachable assertion (WINPR_ASSERT(OutputBufferLength == BytesReturned)) in serial_process_irp_device_control() in channels/serial/client/serial_main.c. When serial device redirection is enabled and a server-controlled IRP_MJ_DEVICE_CONTROL request specifies an unsupported IOCTL with a non-zero OutputBufferLength, CommDeviceIoControl() can fail with BytesReturned = 0, causing the mismatch to trigger the assertion and abort the client process (denial of service).
References
| Link | Resource |
|---|---|
| https://github.com/FreeRDP/FreeRDP/commit/1cc783d4c78bd2f66d3a8582dfe70a663d141444 | Patch |
| https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f | Patch |
| https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pfxq-3qmw-8vjx | Mitigation Vendor Advisory |
| https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-serial-devicecontrol | Patch Third Party Advisory |
Configurations
History
29 Sep 2026, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Freerdp freerdp
Freerdp |
|
| References | () https://github.com/FreeRDP/FreeRDP/commit/1cc783d4c78bd2f66d3a8582dfe70a663d141444 - Patch | |
| References | () https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f - Patch | |
| References | () https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pfxq-3qmw-8vjx - Mitigation, Vendor Advisory | |
| References | () https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-serial-devicecontrol - Patch, Third Party Advisory | |
| CPE | cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:* |
Information
Published : 2026-08-01 13:16
Updated : 2026-09-29 16:17
NVD link : CVE-2026-67303
Mitre link : CVE-2026-67303
CVE.ORG link : CVE-2026-67303
JSON object : View
Products Affected
freerdp
- freerdp
CWE
CWE-617
Reachable Assertion