CVE-2026-73242: FreeRDP: Kerberos GSS Wrap-token `EC` field is unbounded, causing an out-of-bounds decrypt in `kerberos_DecryptMessage`
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberosDecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP peer to trigger out-of-bounds reads and in-place writes during CredSSP/NLA Kerberos decryption. This issue is fixed in version 3.30.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.30.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73242?
CVE-2026-73242 has a risk rating of 62.
What causes the vulnerability CVE-2026-73242 in FreeRDP?
CVE-2026-73242 is caused by the unbounded EC field in the GSS Wrap-token used in the kerberos_DecryptMessage function of FreeRDP.
How can I fix CVE-2026-73242?
To fix CVE-2026-73242, upgrade to FreeRDP version 3.30.0 or later.
What component of FreeRDP is affected by CVE-2026-73242?
The vulnerability affects the kerberos_DecryptMessage function in the winpr/libwinpr/sspi/Kerberos/kerberos.c file of FreeRDP.
What type of attack is enabled by CVE-2026-73242?
CVE-2026-73242 may allow a malicious RDP peer to mount out-of-bounds decryption attacks.