CVE-2026-73242

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberos_DecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP peer to trigger out-of-bounds reads and in-place writes during CredSSP/NLA Kerberos decryption. This issue is fixed in version 3.30.0.

• CWE-122

• https://github.com/FreeRDP/FreeRDP/commit/0adf5e30d01be84e190a359a7bdd37bc51d740ccPatch
• https://github.com/FreeRDP/FreeRDP/pull/13065Issue Tracking, Patch
• https://github.com/FreeRDP/FreeRDP/releases/tag/3.30.0Release Notes
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vv64-95pc-vj9vExploit, Mitigation, Vendor Advisory
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vv64-95pc-vj9vExploit, Mitigation, Vendor Advisory

Published

Aug 11, 2026

Last Modified

Sep 25, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73237XSS vulnerability in Markdown handling in Apache Allura. Th…6.1
• CVE-2026-73238XSS vulnerability in code display in Apache Allura. This is…6.1
• CVE-2026-73239Insecure Direct Object Reference (IDOR) due to missing permi…6.5
• CVE-2026-7324Memory safety bugs present in Thunderbird 150.0.0. Some of t…7.3
• CVE-2026-73240Specifically crafted inputs may lead to git argument injecti…9.8
• CVE-2026-73241FreeRDP is a free implementation of the Remote Desktop Proto…7.5
• CVE-2026-73243kkFileView is a universal file online preview project based …5.8
• CVE-2026-73244kkFileView is a universal file online preview project based …5.3
• CVE-2026-73245Kestra is an open-source, event-driven orchestration platfor…6.5
• CVE-2026-73246Kestra is an open-source, event-driven orchestration platfor…7.5
• CVE-2026-73247Kestra is an open-source, event-driven orchestration platfor…8.6
• CVE-2026-73248calibre is an e-book manager. Prior to 9.12.0, calibre proce…8.5