CVE-2026-73242: FreeRDP Buffer Overflow Vulnerability

CVE-2026-73242 Overview

CVE-2026-73242 is an out-of-bounds read and in-place write vulnerability in FreeRDP, the widely deployed free implementation of the Remote Desktop Protocol (RDP). The flaw resides in the kerberos_DecryptMessage function within winpr/libwinpr/sspi/Kerberos/kerberos.c. FreeRDP fails to bound the peer-controlled GSS Wrap-token Extra Count (EC) field before combining it with the Right Rotation Count (RRC) in IOV pointer offsets. A malicious RDP peer can exploit this during Credential Security Support Provider (CredSSP) / Network Level Authentication (NLA) Kerberos decryption to trigger memory corruption. The issue is fixed in version 3.30.0 and is classified as [CWE-122] Heap-based Buffer Overflow.

Critical Impact
A malicious RDP peer can trigger out-of-bounds memory reads and writes in FreeRDP clients or servers during Kerberos-authenticated CredSSP/NLA sessions, potentially leading to memory corruption and denial of service.

Affected Products

FreeRDP versions prior to 3.30.0
Applications and downstream projects embedding vulnerable FreeRDP winpr libraries
Systems using FreeRDP for CredSSP/NLA Kerberos authentication

Discovery Timeline

2026-08-11 - CVE-2026-73242 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73242

Vulnerability Analysis

The vulnerability affects the Kerberos decryption path used by FreeRDP during CredSSP and NLA authentication. When processing an incoming GSS Wrap token, kerberos_DecryptMessage reads the EC (Extra Count) and RRC (Right Rotation Count) fields directly from the peer-supplied buffer. These values are then used to compute IOV (I/O vector) pointer offsets for the underlying krb5 crypto primitives.

Without proper bounds validation, an attacker-controlled EC value can push offsets outside the allocated buffer. This causes the krb5 crypto routines to read from and write to memory outside the intended token region. Because decryption operates in-place, corrupted writes persist in adjacent heap memory.

Root Cause

The root cause is missing input validation on peer-controlled protocol fields. Specifically, the EC field from the GSS Wrap token header is trusted without verifying that EC + RRC remains within the token length. This is a classic [CWE-122] heap-based buffer overflow, triggered through pointer arithmetic on IOV descriptors passed to krb5.

Attack Vector

Exploitation requires an attacker to act as a malicious RDP peer during a Kerberos-authenticated CredSSP/NLA handshake. The attacker crafts a GSS Wrap token with malformed EC and RRC values. When the victim's FreeRDP process calls kerberos_DecryptMessage to decrypt the token, the out-of-bounds access occurs. Both client-to-server and server-to-client directions are affected, since the vulnerable code path handles decryption on either side.

// Patch: winpr/libwinpr/sspi/Kerberos/kerberos.c
// [winpr,sspi] tighten bounds checks for kerberos
{
#ifdef WITH_KRB5
    KRB_CONTEXT* context = get_context(phContext);
-   PSecBuffer sig_buffer = nullptr;
-   PSecBuffer data_buffer = nullptr;
-   krb5glue_key key = nullptr;
-   krb5_keyusage usage = 0;
-   uint16_t tok_id = 0;
-   BYTE flags = 0;
-   uint16_t ec = 0;
-   uint16_t rrc = 0;
-   uint64_t seq_no = 0;
-   krb5_crypto_iov iov[] = { { KRB5_CRYPTO_TYPE_HEADER, WINPR_C_ARRAY_INIT },
-                             { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
-                             { KRB5_CRYPTO_TYPE_DATA, WINPR_C_ARRAY_INIT },
-                             { KRB5_CRYPTO_TYPE_PADDING, WINPR_C_ARRAY_INIT },
-                             { KRB5_CRYPTO_TYPE_TRAILER, WINPR_C_ARRAY_INIT } };
-
    if (!context)
        return SEC_E_INVALID_HANDLE;
// Source: https://github.com/FreeRDP/FreeRDP/commit/0adf5e30d01be84e190a359a7bdd37bc51d740cc

The patch restructures the function to enforce bounds checks on ec and rrc before they are used in IOV offset calculations. See the FreeRDP security patch commit and Pull Request #13065 for the complete fix.

Detection Methods for CVE-2026-73242

Indicators of Compromise

FreeRDP process crashes or unexpected termination during CredSSP/NLA authentication handshakes
Heap corruption signatures reported by AddressSanitizer, glibc malloc checks, or Electric Fence in FreeRDP builds
RDP session negotiations initiated by untrusted peers that reference Kerberos GSS-API and terminate abnormally before a session is established

Detection Strategies

Inventory all systems running FreeRDP xfreerdp, wlfreerdp, or embedded libwinpr and compare installed versions against 3.30.0.
Monitor RDP servers and clients for repeated NLA authentication failures paired with process termination in system logs.
Inspect network telemetry for RDP connections carrying malformed CredSSP TSRequest structures from unexpected sources.

Monitoring Recommendations

Enable core dump collection on hosts running FreeRDP so post-crash analysis can confirm heap corruption in kerberos.c.
Log outbound RDP connections from user workstations to detect scenarios where a compromised server targets FreeRDP clients.
Alert on any FreeRDP-derived binaries loading unexpected libraries or spawning child processes following an authentication attempt.

How to Mitigate CVE-2026-73242

Immediate Actions Required

Upgrade FreeRDP to version 3.30.0 or later on all systems, including packaged distributions and embedded uses.
Audit downstream software that statically links or bundles libwinpr and rebuild against the patched release.
Restrict RDP connectivity to trusted peers using network segmentation and firewall rules until patching is complete.

Patch Information

The fix is available in FreeRDP Release 3.30.0. Technical details are documented in GitHub Security Advisory GHSA-vv64-95pc-vj9v and the corresponding commit 0adf5e30. The patch tightens bounds checks around the EC and RRC fields in kerberos_DecryptMessage before they are used in IOV pointer arithmetic.

Workarounds

Disable Kerberos-based CredSSP/NLA where operationally feasible and require alternative authentication mechanisms until systems are patched.
Block inbound and outbound RDP (TCP/UDP 3389) at network boundaries and permit only allow-listed source and destination hosts.
Route RDP traffic through an authenticated gateway or VPN so untrusted peers cannot reach the vulnerable code path directly.

bash

# Verify installed FreeRDP version and upgrade
xfreerdp --version

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade freerdp3-x11 libwinpr3-3

# Fedora/RHEL
sudo dnf upgrade freerdp libwinpr

# Build from source (patched release)
git clone --branch 3.30.0 https://github.com/FreeRDP/FreeRDP.git
cd FreeRDP && cmake -B build -S . && cmake --build build