CVE-2026-73242

CriticalCVSS 9.1/10Last modified Sep 25, 2026

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberos_DecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP peer to trigger out-of-bounds reads and in-place writes during CredSSP/NLA Kerberos decryption. This issue is fixed in version 3.30.0.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-122

Affected software

Vendor	Product	Versions
FreeRDP	FreeRDP	< 3.30.0

References

https://github.com/FreeRDP/FreeRDP/commit/0adf5e30d01be84e190a359a7bdd37bc51d740ccPatch
https://github.com/FreeRDP/FreeRDP/pull/13065Issue Tracking, Patch
https://github.com/FreeRDP/FreeRDP/releases/tag/3.30.0Release Notes
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vv64-95pc-vj9vExploit, Mitigation, Vendor Advisory
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vv64-95pc-vj9vExploit, Mitigation, Vendor Advisory

Timeline

Published: Aug 11, 2026
Last modified: Sep 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-732435.8kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkF CVE-2026-732445.3kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in CVE-2026-732456.5Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Mi CVE-2026-732467.5Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/W CVE-2026-732478.6Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/fun CVE-2026-732488.5calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF,CVE-2026-732497.5calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt CVE-2026-73257.1Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authenticated user to obtain a CVE-2026-732505.4Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker CVE-2026-732519.1Mongoose is an embedded web server and network library. Prior to 7.23, a network attacker can impersonate a TLS server to a Mongoose client CVE-2026-732527.5Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.CVE-2026-732539.1Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a