FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberos_DecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP peer to trigger out-of-bounds reads and in-place writes during CredSSP/NLA Kerberos decryption. This issue is fixed in version 3.30.0.
References
| Link | Resource |
|---|---|
| https://github.com/FreeRDP/FreeRDP/commit/0adf5e30d01be84e190a359a7bdd37bc51d740cc | Patch |
| https://github.com/FreeRDP/FreeRDP/pull/13065 | Issue Tracking Patch |
| https://github.com/FreeRDP/FreeRDP/releases/tag/3.30.0 | Release Notes |
| https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vv64-95pc-vj9v | Exploit Mitigation Vendor Advisory |
| https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vv64-95pc-vj9v | Exploit Mitigation Vendor Advisory |
Configurations
History
25 Sep 2026, 14:59
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Freerdp freerdp
Freerdp |
|
| CPE | cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
| References | () https://github.com/FreeRDP/FreeRDP/commit/0adf5e30d01be84e190a359a7bdd37bc51d740cc - Patch | |
| References | () https://github.com/FreeRDP/FreeRDP/pull/13065 - Issue Tracking, Patch | |
| References | () https://github.com/FreeRDP/FreeRDP/releases/tag/3.30.0 - Release Notes | |
| References | () https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vv64-95pc-vj9v - Exploit, Mitigation, Vendor Advisory |
Information
Published : 2026-08-11 20:18
Updated : 2026-09-25 14:59
NVD link : CVE-2026-73242
Mitre link : CVE-2026-73242
CVE.ORG link : CVE-2026-73242
JSON object : View
Products Affected
freerdp
- freerdp
CWE
CWE-122
Heap-based Buffer Overflow