CVE-2026-73242 FreeRDP CVE debrief

Who should care

Defenders responsible for Remote Desktop Protocol infrastructure, particularly those using FreeRDP, should assess exposure and prioritize patching or mitigating this vulnerability.

Why it matters

CVE-2026-73242 is a high-severity vulnerability in FreeRDP that allows a malicious RDP peer to trigger out-of-bounds reads and in-place writes during CredSSP/NLA Kerberos decryption. Defenders responsible for Remote Desktop Protocol infrastructure, particularly those using FreeRDP, should assess exposure and prioritize patching or mitigating this vulnerability.

• Potential for out-of-bounds reads and in-place writes during CredSSP/NLA Kerberos decryption
• Possible disruption of Remote Desktop Protocol services
• Need for patching or upgrading FreeRDP to version 3.30.0 or later
• Importance of monitoring Remote Desktop Protocol traffic for suspicious activity

Technical summary

The vulnerability exists in the kerberos_DecryptMessage function, which fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets. This allows a malicious RDP peer to trigger out-of-bounds reads and in-place writes during CredSSP/NLA Kerberos decryption. The issue is fixed in version 3.30.0. FreeRDP is a free implementation of the Remote Desktop Protocol. Defenders responsible for Remote Desktop Protocol infrastructure, particularly those using FreeRDP, should assess exposure and prioritize patching or mitigating this vulnerability.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Remote Desktop Protocol is used.

Recommended defensive actions

• Patch or upgrade FreeRDP to version 3.30.0 or later
• Implement network segmentation and isolation to limit the attack surface
• Monitor Remote Desktop Protocol traffic for suspicious activity
• Consider implementing additional security controls, such as multi-factor authentication
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the CVE record and NVD vulnerability detail page. The issue is fixed in version 3.30.0, according to the FreeRDP release notes. FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberos_DecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP peer to trigger out-of-bounds reads and in-place writes during CredSSP/NLA Kerberos decryption. Evidence is limited to public CVE and NVD records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.