CVE-2026-73242

Received Received - Intake

Heap-based Buffer Overflow in FreeRDP

Publication date: 2026-08-11

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberos_DecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP peer to trigger out-of-bounds reads and in-place writes during CredSSP/NLA Kerberos decryption. This issue is fixed in version 3.30.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-12

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73242

EUVD

EUVD-2026-56935

Affected Vendors & Products

Vendor	Product	Version / Range
freerdp	freerdp	to 3.30.0 (exc)
freerdp	freerdp	to 3.29.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability in FreeRDP involves improper bounds checking in the Kerberos authentication process. A malicious RDP peer can exploit a flaw in the kerberos_DecryptMessage function to set an unbounded GSS Wrap-token EC field, causing out-of-bounds memory reads and writes during CredSSP/NLA Kerberos decryption.

Detection Guidance

To detect this vulnerability, check the FreeRDP version installed on your system. Run: freerdp2-shadow --version or apt list --installed | grep freerdp. If the version is below 3.30.0, the system is vulnerable. Monitor network traffic for unusual Kerberos decryption errors or crashes in FreeRDP services.

Impact Analysis

An attacker could exploit this to execute arbitrary code, crash the application, or gain unauthorized access to systems using FreeRDP for remote desktop connections. It affects both clients and servers due to peer-controlled token manipulation.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing sensitive data during RDP sessions. Out-of-bounds memory access during Kerberos decryption may lead to unauthorized data disclosure or modification, violating confidentiality requirements in both regulations. GDPR emphasizes data protection and breach notification, while HIPAA mandates secure transmission of protected health information.

Mitigation Strategies

Upgrade FreeRDP to version 3.30.0 or later immediately. If upgrading is not possible, disable Kerberos-based NLA authentication in FreeRDP configurations or restrict RDP access to trusted networks only. Apply patches from the FreeRDP repository if available.

Hi! I’m here to help you understand CVE-2026-73242. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70