Skip to main content

FreeRDP EUVDEUVD-2026-56935

| CVE-2026-73242 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-08-11 security-advisories@github.com
Heap Overflow Buffer Overflow Red Hat Suse
8.3
CVSS 4.0 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
8.3 HIGH
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.0 HIGH

Network attack during NLA/Kerberos handshake requires high complexity and specific prerequisites; heap OOB write gives limited integrity impact but reliable availability impact from crash.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
6.4 MEDIUM
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H
Red Hat
6.4 MEDIUM
qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Aug 11, 2026 - 21:18 EUVD
Source Code Evidence Fetched
Aug 11, 2026 - 20:59 vuln.today
Analysis Generated
Aug 11, 2026 - 20:59 vuln.today
CVE Published
Aug 11, 2026 - 20:18 cve.org
HIGH 8.3

DescriptionCVE.org

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberos_DecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP peer to trigger out-of-bounds reads and in-place writes during CredSSP/NLA Kerberos decryption. This issue is fixed in version 3.30.0.

AnalysisAI

Heap out-of-bounds read and write in FreeRDP's Kerberos SSPI layer (all versions prior to 3.30.0) allows a malicious RDP peer to corrupt memory during CredSSP/NLA Kerberos decryption by supplying a crafted GSS Wrap-token with an unbounded EC or EC+RRC field value. The flaw sits in the pre-session authentication path, meaning exploitation does not require an established authenticated session from the attacker's side. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the victim FreeRDP client or server is configured to use NLA/Kerberos authentication (CredSSP with Kerberos as the underlying SSPI mechanism), which is the default in enterprise Active Directory environments but may not be active in standalone or non-domain RDP setups. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H) places the primary impact on availability with secondary low-confidence confidentiality and integrity leakage, consistent with a heap corruption that most reliably causes a crash but may be further exploitable with heap-layout control. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade FreeRDP to version 3.30.0 or later, which is confirmed to contain the bounds-checking fix introduced in commit 0adf5e30d01be84e190a359a7bdd37bc51d740cc (https://github.com/FreeRDP/FreeRDP/commit/0adf5e30d01be84e190a359a7bdd37bc51d740cc) via PR #13065 (https://github.com/FreeRDP/FreeRDP/pull/13065); the official release is available at https://github.com/FreeRDP/FreeRDP/releases/tag/3.30.0. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: inventory systems running FreeRDP versions prior to 3.30.0 and assess RDP exposure scope; implement immediate firewall rules restricting RDP access to known administrative IP ranges only. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8
CVE-2025-24993 HIGH
7.8
CVE-2024-30085 HIGH POC
7.8

Same technique Heap Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2025-5419 HIGH POC
8.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8
CVE-2023-23376 HIGH
7.8
CVE-2024-30085 HIGH POC
7.8
CVE-2023-6246 HIGH POC
8.4

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

EUVD-2026-56935 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy