CVE-2026-73242

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.30.0

Description The kerberos DecryptMessage() function in the winpr/libwinpr/sspi/Kerberos/kerberos.c file fails to properly bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets. This heap buffer overflow allows a malicious RDP peer to trigger out-of-bounds reads and in-place writes during CredSSP/NLA Kerberos decryption, which could lead to the disclosure of protected information or a denial of service.

Recommendations Update to version 3.30.0.