CVE-2026-73242CWE-122

CVE-2026-73242

Critical · published August 12, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
33.0
In the wild
Unconfirmed
What it is

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberos_DecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP peer to trigger out-of-bounds reads and in-place writes during CredSSP/NLA Kerberos decryption. This issue is fixed in version 3.30.0.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00399 · 33.0th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2026-08-12T00:18Z
Affected products (1)
ProductVersionsFixed in
freerdp/freerdp< 3.30.03.30.0
References (5)
https://github.com/FreeRDP/FreeRDP/commit/0adf5e30d01be84e190a359a7bdd37bc51d740cc · [email protected]https://github.com/FreeRDP/FreeRDP/pull/13065 · [email protected]https://github.com/FreeRDP/FreeRDP/releases/tag/3.30.0 · [email protected]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vv64-95pc-vj9v · [email protected]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vv64-95pc-vj9v · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 11 AUG 19:49Z
    FreeRDP: Kerberos GSS Wrap-token `EC` field is unbounded, causing an out-of-bounds decrypt in `kerberos_DecryptMessage`
    cvelistv5