CVE-2026-73242 is a critical (CVSS 9.1) heap memory flaw in FreeRDP versions before 3.30.0. A malicious RDP peer can cause out-of-bounds reads and writes while the client decrypts a Kerberos token during CredSSP and NLA. Upgrade FreeRDP to 3.30.0 or rebuild your applications against it.
What's affected
FreeRDP 3.29.0 and earlier, fixed in 3.30.0, according to the GitHub advisory and the NVD record. The advisory says the vulnerable code is in winpr/libwinpr/sspi/Kerberos/kerberos.c, in the function kerberos_DecryptMessage, and that it applies to builds with Kerberos support (WITH_KRB5).
The direction matters. The attacker is the RDP peer, so the people at risk are those who connect with a FreeRDP based client to a server they do not fully control, or to a server that has been compromised. FreeRDP is also a library. Remote desktop clients and other tools may bundle or link it, so the real version may be hidden inside another package.
The advisory notes it was found using AI assisted tooling, reviewed by hand, and demonstrated with a harness style reproducer rather than a full end to end one.
How to check if you're exposed
For the command line client, ask for the version.
xfreerdp /version
For packages on Debian or Ubuntu style systems:
dpkg -l | grep -i freerdp
On RPM based systems:
rpm -qa | grep -i freerdp
Look for 3.29.0 or earlier. Then find applications that depend on the library. Package managers can list them, for example with apt rdepends on the library package. Applications that ship their own copy, such as some Flatpak or Snap builds and bundled products, need a vendor update.
What to do now
- Upgrade FreeRDP to 3.30.0 or newer, or install your distribution's update that includes the fix.
- Update or rebuild applications that bundle libfreerdp, and ask vendors of products that embed it for their status.
- Until you can patch, avoid connecting FreeRDP clients to servers you do not trust.
- Confirm whether your build has Kerberos support enabled, since the advisory ties the flaw to those builds.
- Check distribution security trackers, as backported fixes may not change the visible version number.
Why it matters
The record maps this to CWE-122, a heap based buffer overflow. The advisory describes the cause. A Kerberos wrap token carries a field called EC, which says how many extra bytes follow. FreeRDP checked the other length fields but never checked EC, then used it in pointer arithmetic to find the encrypted parts of the message. A large value pushes those pointers past the end of the buffer.
The decryption mode used for this exchange decrypts first and checks the integrity afterwards. That ordering means the out-of-bounds read and write happen before the integrity check gets a chance to reject the message. Every length that came from the network needs a bound before it is used to compute an address.
This kind of bug is why reachability matters. A vulnerable library in your inventory is only a problem if the vulnerable function can be reached, and here that means Kerberos enabled builds connecting to untrusted peers. The record's KEV flag is false.
Where FreeRDP hides in your estate
The hard part of a library flaw is finding every copy. FreeRDP is used by command line clients, graphical remote desktop tools, and products that embed it for session handling. Some link the system library, so one distribution update fixes them all. Others carry their own copy, and those need a vendor release. Start with your software bill of materials if you have one, and search it for freerdp and libfreerdp. If you do not, a scan of your hosts and images for the library file names is a reasonable first pass.
Reachability analysis helps with prioritization. The advisory's conditions are narrow: a build with Kerberos support, a connection that uses CredSSP with Kerberos, and a peer that is not trustworthy. A jump host that connects to many external servers is a different risk from a kiosk that only talks to one internal server. Rank the fixes by who the clients connect to, and patch the exposed ones first.
What the advisory teaches about network length fields
A field like EC travels in the packet header, so the sender picks its value. Code that uses such a value to compute where to read or write has to check it against the real buffer size first. The advisory says the code validated one related field and the overall length, but never the extra count, and that the decryption mode decrypts before verifying integrity, so the damage happens before the message can be rejected. For reviewers of C protocol code, a simple rule applies: every number taken from the wire is hostile until it has been bounded.
The free in-browser dependency scan at gold.safeguard.sh/scan can show whether a project you maintain pulls in an affected package, and the Gold vulnerability directory keeps the record for this CVE.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Who is the attacker in CVE-2026-73242?
The RDP server, or anyone who can sit in its place. The flaw is in the client side handling of the server's token.
Does my build use Kerberos?
The advisory refers to builds with WITH_KRB5. Check your build options or distribution package details.
Sources
Last reviewed: 19 October 2026.
