CVE-2026-67303 Overview
CVE-2026-67303 is a denial of service vulnerability in FreeRDP versions before 3.29.0. The flaw resides in serial_process_irp_device_control() within channels/serial/client/serial_main.c. A malicious or compromised RDP server can trigger a reachable assertion (WINPR_ASSERT(OutputBufferLength == BytesReturned)) that aborts the FreeRDP client process. Exploitation requires that serial device redirection be enabled on the client and that the user connect to an attacker-controlled server. The weakness is classified under CWE-617: Reachable Assertion.
Critical Impact
A server-controlled IRP_MJ_DEVICE_CONTROL request with an unsupported IOCTL and non-zero OutputBufferLength causes the FreeRDP client to abort, terminating any active RDP session.
Affected Products
- FreeRDP versions prior to 3.29.0
- FreeRDP clients with serial device redirection enabled
- Downstream distributions bundling vulnerable FreeRDP releases
Discovery Timeline
- 2026-08-01 - CVE-2026-67303 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-67303
Vulnerability Analysis
The vulnerability is a reachable assertion in the FreeRDP serial channel client. When serial redirection is negotiated, the RDP server can send IRP_MJ_DEVICE_CONTROL requests that the client dispatches to serial_process_irp_device_control(). The client invokes CommDeviceIoControl() to process the IOCTL and then asserts that the number of bytes returned matches the caller-supplied OutputBufferLength.
When the server specifies an unsupported IOCTL together with a non-zero OutputBufferLength, CommDeviceIoControl() fails and sets BytesReturned to 0. The subsequent WINPR_ASSERT compares 0 against the non-zero OutputBufferLength, the condition fails, and the client aborts. This terminates the RDP session and any associated user work.
Root Cause
The root cause is defensive programming applied incorrectly: an assertion is used to validate untrusted, network-controlled input. Assertions abort the process on failure and are not appropriate for handling protocol errors from remote peers. The correct behavior is to return an error status to the server and continue processing.
Attack Vector
Exploitation requires user interaction: the victim must initiate an RDP connection to a server the attacker controls or has compromised. Serial port redirection must be enabled on the FreeRDP client. Once the session is established, the malicious server sends a crafted IRP_MJ_DEVICE_CONTROL device I/O request specifying any unsupported IOCTL code and a non-zero output buffer length. No authentication to the client is required beyond the standard RDP session negotiation.
The fix landed in FreeRDP 3.29.0. Refer to the FreeRDP GHSA-pfxq-3qmw-8vjx advisory and the VulnCheck FreeRDP advisory for full technical details.
Detection Methods for CVE-2026-67303
Indicators of Compromise
- Unexpected termination of xfreerdp, wfreerdp, or embedded FreeRDP client processes during active RDP sessions.
- Client-side log entries referencing serial_process_irp_device_control immediately preceding a crash or SIGABRT.
- Repeated abort signals on hosts that connect to untrusted or newly observed RDP endpoints with serial redirection enabled.
Detection Strategies
- Inventory endpoints running FreeRDP and identify versions below 3.29.0 using software asset management data.
- Correlate RDP outbound connections with subsequent client process crashes to identify potentially malicious servers.
- Monitor for command-line invocations of FreeRDP clients using the /serial redirection switch to scope exposure.
Monitoring Recommendations
- Collect crash telemetry (core dumps, Windows Error Reporting) from workstations that use FreeRDP for outbound RDP.
- Log destination IP and hostname of every FreeRDP session and alert on connections to servers outside approved allow lists.
- Track FreeRDP package versions across managed hosts and generate alerts when unpatched builds are observed.
How to Mitigate CVE-2026-67303
Immediate Actions Required
- Upgrade FreeRDP to version 3.29.0 or later on all managed clients and rebuild downstream applications that link against libfreerdp.
- Disable serial device redirection on FreeRDP clients that do not require it, either through configuration or by omitting the /serial command-line flag.
- Restrict outbound RDP connections to trusted, authenticated servers using network policy or an RDP gateway.
Patch Information
The issue is addressed in FreeRDP 3.29.0. Distribution maintainers should backport the upstream fix into supported branches. See the FreeRDP security advisory GHSA-pfxq-3qmw-8vjx for the authoritative patch reference.
Workarounds
- Launch FreeRDP without the serial redirection flag until patched builds are deployed.
- Only connect to RDP servers under organizational control; avoid ad-hoc connections to third-party endpoints.
- Where possible, run FreeRDP clients inside a sandbox or restricted user session so that an abort does not impact the broader workstation state.
# Example: launch FreeRDP without serial redirection
xfreerdp /v:rdp.example.internal /u:analyst /cert:tofu
# Verify installed version meets the fixed release
xfreerdp --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
