CVE-2026-67303— FreeRDP before 3.29.0 Denial of Service via serial DeviceControl
Possible ATT&CK Techniques 1AI
T1499 · Endpoint Denial of ServiceGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-67303
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FreeRDP before 3.29.0 Denial of Service via serial DeviceControl
Source: CVE Program / CVE List V5
Vulnerability Description
FreeRDP before 3.29.0 contains a reachable assertion (WINPR_ASSERT(OutputBufferLength == BytesReturned)) in serial_process_irp_device_control() in channels/serial/client/serial_main.c. When serial device redirection is enabled and a server-controlled IRP_MJ_DEVICE_CONTROL request specifies an unsupported IOCTL with a non-zero OutputBufferLength, CommDeviceIoControl() can fail with BytesReturned = 0, causing the mismatch to trigger the assertion and abort the client process (denial of service).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
可达断言
Source: CVE Program / CVE List V5
Vulnerability Title
FreeRDP 异常处理不当漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FreeRDP是FreeRDP团队开源的一款远程桌面协议(RDP)的实现。 FreeRDP 3.29.0之前版本存在安全漏洞，该漏洞源于serial_process_irp_device_control函数中存在可达断言，当串口设备重定向启用且服务器控制的IRP_MJ_DEVICE_CONTROL请求指定不支持的IOCTL且OutputBufferLength非零时，CommDeviceIoControl可能失败，导致断言触发并中止客户端进程，造成拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-67303
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-67303
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-67303 (2)
Vendor Advisories for CVE-2026-67303 (2)
Same Patch Batch · FreeRDP · 2026-08-01 · 21 CVEs total
| CVE-2026-66402 | 9.8 CRITICAL | FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass |
| CVE-2026-67289 | 9.8 CRITICAL | FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection |
| CVE-2026-67305 | 9.4 CRITICAL | FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr |
| CVE-2026-67288 | 7.5 HIGH | FreeRDP before 3.29.0 Denial of Service via smartcard cache |
| CVE-2026-67296 | 7.5 HIGH | FreeRDP before 3.29.0 Denial of Service via RDPEI PDU |
| CVE-2026-67290 | 7.5 HIGH | FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF |
| CVE-2026-67304 | 7.5 HIGH | FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup |
| CVE-2026-67300 | 7.5 HIGH | FreeRDP before 3.29.0 Use-After-Free via async message proxy |
| CVE-2026-67301 | 7.5 HIGH | FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy |
| CVE-2026-67298 | 7.5 HIGH | FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow |
| CVE-2026-67297 | 7.5 HIGH | FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response |
| CVE-2026-67299 | 7.5 HIGH | FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message |
| CVE-2026-67291 | 7.5 HIGH | FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD |
| CVE-2026-67292 | 6.5 MEDIUM | FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure |
| CVE-2026-67295 | 6.3 MEDIUM | FreeRDP before 3.29.0 Path Traversal via drive redirection |
| CVE-2026-67294 | 5.9 MEDIUM | FreeRDP before 3.29.0 TLS Certificate EKU Bypass |
| CVE-2026-67306 | 5.4 MEDIUM | FreeRDP before 3.29.0 Out-of-Bounds Read via Planar RLE |
| CVE-2026-67302 | 4.3 MEDIUM | FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service |
| CVE-2026-67293 | 4.2 MEDIUM | FreeRDP before 3.29.0 Improper Certificate Hostname Validation |
| CVE-2026-66401 | 2.1 LOW | FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264 |
IV. Related Vulnerabilities
Same product: FreeRDP
- CVE-2026-68580
FreeRDP before 3.29.0 Integer Overflow via Audio Input Chann - CVE-2026-68579
FreeRDP before 3.30.0 Heap Overflow via CliprdrStream_Read - CVE-2026-66401
FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264 - CVE-2026-67298
FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Und - CVE-2026-67288
FreeRDP before 3.29.0 Denial of Service via smartcard cache
Same vendor: FreeRDP
- CVE-2026-68580
FreeRDP before 3.29.0 Integer Overflow via Audio Input Chann - CVE-2026-68579
FreeRDP before 3.30.0 Heap Overflow via CliprdrStream_Read - CVE-2026-67298
FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Und - CVE-2026-67288
FreeRDP before 3.29.0 Denial of Service via smartcard cache - CVE-2026-66401
FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264
Same weakness: CWE-617
- CVE-2026-18581
ggml-org llama.cpp Jinja Minja Template parser.cpp assertion - CVE-2026-66754
Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_pre - CVE-2026-17574
NULL Pointer Dereference in HDF5 via Invalid Variable-Length - CVE-2026-17513
ggml-org whisper.cpp ggml.c ggml_ftype_to_ggml_type assertio - CVE-2026-45815
Apache NimBLE: Remote reachable assertion in ATT Read Multip
V. Comments for CVE-2026-67303
No comments yet