FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberos_DecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP peer to trigger out-of-bounds reads and in-place writes during CredSSP/NLA Kerberos decryption. This issue is fixed in version 3.30.0.
CVSS Details
- CVSS 4.0 Base Score: 8.3 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade libwinprUpgrade freerdp-server-debuginfoUpgrade freerdp-libs-debuginfoUpgrade freerdpUpgrade freerdp-debugsourceUpgrade freerdp-libsUpgrade libwinpr-develUpgrade freerdp-develUpgrade libwinpr-debuginfoUpgrade freerdp-debuginfoUpgrade freerdp-server | Sep 1, 2026 | Aug 11, 2026 |
| Redhat_linux | — | Upgrade freerdp-debuginfoUpgrade freerdp-develUpgrade freerdpUpgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade libwinprUpgrade libwinpr-debuginfoUpgrade freerdp-server-debuginfoUpgrade freerdp-libs-debuginfoUpgrade freerdp-libsUpgrade freerdp-server | Sep 2, 2026 | Aug 11, 2026 |
| Rocky_linux | — | Upgrade libwinprUpgrade freerdp-develUpgrade freerdp-server-debuginfoUpgrade freerdpUpgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade freerdp-serverUpgrade libwinpr-debuginfoUpgrade freerdp-libsUpgrade freerdp-debuginfoUpgrade freerdp-libs-debuginfo | Sep 3, 2026 | Sep 1, 2026 |
| Ubuntu | — | Upgrade freerdp3 | Aug 17, 2026 | Aug 13, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub