Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-01T12:22:18 FreeRDP: FreeRDP: Denial of Service via unsupported serial device control request 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CWE-617

FreeRDP before 3.29.0 contains a reachable assertion (WINPR_ASSERT(OutputBufferLength == BytesReturned)) in serial_process_irp_device_control() in channels/serial/client/serial_main.c. When serial device redirection is enabled and a server-controlled IRP_MJ_DEVICE_CONTROL request specifies an unsupported IOCTL with a non-zero OutputBufferLength, CommDeviceIoControl() can fail with BytesReturned = 0, causing the mismatch to trigger the assertion and abort the client process (denial of service).

A flaw was found in FreeRDP. When serial device redirection is active, a malicious server can send a crafted device control request. If this request specifies an unsupported operation with a non-zero output buffer, it can cause the FreeRDP client process to unexpectedly terminate. This leads to a denial of service, preventing the client from maintaining its remote desktop connection.

This issue is classified as Moderate severity because exploitation requires serial device redirection to be active and a user connecting to a malicious server, where a crafted device control request triggers an application process crash resulting solely in a localized denial of service. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Enterprise Linux 10 Fix deferred freerdp Red Hat Enterprise Linux 6 Out of support scope freerdp Red Hat Enterprise Linux 7 Out of support scope freerdp Red Hat Enterprise Linux 8 Fix deferred freerdp Red Hat Enterprise Linux 9 Fix deferred freerdp https://www.cve.org/CVERecord?id=CVE-2026-67303 https://nvd.nist.gov/vuln/detail/CVE-2026-67303 https://github.com/FreeRDP/FreeRDP/commit/1cc783d4c78bd2f66d3a8582dfe70a663d141444 https://github.com/FreeRDP/FreeRDP/commit/5370fb26fbf034ecd11d3026b6ad639b5fff493f https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pfxq-3qmw-8vjx https://www.vulncheck.com/advisories/freerdp-before-denial-of-service-via-serial-devicecontrol