Skip to main content

FreeRDP CVE-2026-67303

| EUVDEUVD-2026-51818 MEDIUM
Reachable Assertion (CWE-617)
2026-08-01 VulnCheck GHSA-4wq4-c34j-gg99
Denial Of Service Freerdp
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

Network vector with user interaction required (client must connect to malicious server); no privileges needed on the target; availability impact is low and scoped to the client process only.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
4.3 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Red Hat
4.3 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Aug 01, 2026 - 13:30 vuln.today
Analysis Generated
Aug 01, 2026 - 13:30 vuln.today

DescriptionCVE.org

FreeRDP before 3.29.0 contains a reachable assertion (WINPR_ASSERT(OutputBufferLength == BytesReturned)) in serial_process_irp_device_control() in channels/serial/client/serial_main.c. When serial device redirection is enabled and a server-controlled IRP_MJ_DEVICE_CONTROL request specifies an unsupported IOCTL with a non-zero OutputBufferLength, CommDeviceIoControl() can fail with BytesReturned = 0, causing the mismatch to trigger the assertion and abort the client process (denial of service).

AnalysisAI

Serial device redirection in FreeRDP before 3.29.0 exposes RDP clients to a server-induced denial of service via a reachable assertion in the serial channel plugin. A malicious or compromised RDP server can send a crafted IRP_MJ_DEVICE_CONTROL request referencing an unsupported IOCTL with a non-zero OutputBufferLength, causing CommDeviceIoControl() to return BytesReturned=0 and firing the WINPR_ASSERT that aborts the client process. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the server-controlled trigger makes this straightforward to weaponize against users connecting to untrusted servers with serial redirection enabled.

Technical ContextAI

FreeRDP is an open-source implementation of the Remote Desktop Protocol used across Linux, macOS, and Windows environments. The flaw resides in channels/serial/client/serial_main.c within the serial_process_irp_device_control() function, which handles I/O Request Packets (IRPs) forwarded from the RDP server to a redirected serial device on the client. The specific assertion WINPR_ASSERT(OutputBufferLength == BytesReturned) is intended as a consistency check ensuring the device control response matches the requested output buffer size. When CommDeviceIoControl() encounters an unsupported IOCTL code, it returns with BytesReturned=0 rather than propagating an error, creating a mismatch that fires the assertion and terminates the process via abort(). CWE-617 (Reachable Assertion) describes this root cause class: a program assertion reachable through attacker-controlled input that causes abnormal termination. The affected CPE cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:* covers all releases before 3.29.0. Two patch commits address this: 1cc783d4c78bd2f66d3a8582dfe70a663d141444 and 5370fb26fbf034ecd11d3026b6ad639b5fff493f.

RemediationAI

Upgrade FreeRDP to version 3.29.0 or later, which resolves the assertion via commits 1cc783d4c78bd2f66d3a8582dfe70a663d141444 and 5370fb26fbf034ecd11d3026b6ad639b5fff493f; the vendor advisory is at https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pfxq-3qmw-8vjx. Upstream fix commits are confirmed; the tagged release version 3.29.0 is referenced by the EUVD entry. If upgrading immediately is not feasible, disable serial device redirection in the FreeRDP client configuration (removing the /serial or equivalent channel argument from connection parameters) - this completely eliminates the vulnerable code path with no impact on sessions that do not require serial port forwarding. Organizations using RDP clients derived from the FreeRDP library (such as Remmina or xfreerdp wrappers) should verify whether their distribution has backported the fix or ships an updated package.

More in Freerdp

View all
CVE-2026-25997 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth

CVE-2026-25953 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti
CVE-2026-25952 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor
CVE-2026-25959 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem
CVE-2026-22857 CRITICAL POC
9.8 Jan 14

FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi
CVE-2026-22854 CRITICAL POC
9.8 Jan 14

FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai
CVE-2026-22852 CRITICAL POC
9.8 Jan 14

FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m
CVE-2026-25955 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and

CVE-2024-32041 CRITICAL POC
9.8 Apr 22

FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-40574 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40569 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40567 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

Same weakness CWE-617 – Reachable Assertion

View all
CVE-2025-15684 MEDIUM POC
5.5
CVE-2016-8864 HIGH
7.5
CVE-2020-12417 HIGH POC
8.8
CVE-2020-6623 HIGH POC
8.8
CVE-2020-6619 HIGH POC
8.8
CVE-2020-6617 HIGH POC
8.8
CVE-2023-37023 HIGH POC
8.6
CVE-2023-37021 HIGH POC
8.6

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-67303 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy