CVE-2026-72745
Received Received - Intake

Out-of-Bounds Read in FreeRDP Kerberos Authentication

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: VulnCheck

Description
FreeRDP before 3.30.0 contains an out-of-bounds vulnerability in kerberos_DecryptMessage() (winpr/libwinpr/sspi/Kerberos/kerberos.c). The 16-bit EC (extra count) field of a peer-supplied GSS Wrap token (RFC 4121) is used directly in pointer arithmetic to locate the encrypted regions without being bounds-checked, while only RRC and the total buffer length are validated. A malicious peer (server or client) can supply a large EC value (up to 0xFFFF) during CredSSP/NLA authentication, moving the decrypt operation's base pointers past the end of the ~60-byte token buffer. Because the AES-CTS-HMAC enctypes decrypt in place before the HMAC integrity check, this results in an out-of-bounds read and in-place out-of-bounds write, potentially leading to information disclosure, memory corruption, or denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72745
EUVD
EUVD-2026-56135

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freerdp freerdp to 3.30.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeRDP before version 3.30.0 has an out-of-bounds vulnerability in the kerberos_DecryptMessage() function. A malicious peer can supply a large EC field in a GSS Wrap token, causing pointer arithmetic to access memory outside the token buffer during decryption. This leads to out-of-bounds read and write operations before integrity checks, potentially causing information disclosure, memory corruption, or denial of service.

Detection Guidance

Detecting this vulnerability requires checking FreeRDP versions before 3.30.0. Use commands like 'xfreerdp --version' or 'apt list --installed | grep freerdp' to verify installed versions. Monitor network traffic for unusual Kerberos GSS Wrap token exchanges during CredSSP/NLA authentication.

Impact Analysis

If exploited, this vulnerability could allow attackers to read sensitive memory, corrupt system memory, or crash applications using FreeRDP. It is particularly dangerous during CredSSP/NLA authentication, where a malicious server or client could target FreeRDP users or servers.

Mitigation Strategies

Immediately upgrade FreeRDP to version 3.30.0 or later. Disable Kerberos-based authentication if not required. Apply network-level mitigations like restricting RDP access to trusted networks. Monitor for suspicious activity during authentication attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72745. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart