FreeRDP: Four High Severity Flaws in RDSTLS and Kerberos Patched Together
Four High severity vulnerabilities in FreeRDP, impacting RDSTLS and Kerberos security, were disclosed together and patched in version 3.30.0.
Key findings
- Four High severity vulnerabilities disclosed for FreeRDP on August 11, 2026.
- Two vulnerabilities stem from flaws in the RDSTLS handshake, enabling authentication bypass.
- Two vulnerabilities involve out-of-bounds memory access in the Kerberos decryption process.
- All disclosed vulnerabilities are addressed in FreeRDP version 3.30.0.
- Affected versions are prior to 3.30.0.
On August 11, 2026, a batch of four High severity vulnerabilities were disclosed for the FreeRDP remote desktop protocol implementation. These vulnerabilities, all patched in version 3.30.0, collectively impact the security of RDP connections by allowing for potential authentication bypasses and out-of-bounds memory access. The disclosures highlight critical flaws in how FreeRDP handles security protocols like RDSTLS and Kerberos, underscoring the importance of timely patching for systems utilizing this software.
Two of the vulnerabilities, CVE-2026-73241 and CVE-2026-72746, stem from weaknesses in the RDSTLS handshake process. CVE-2026-73241 describes how the FreeRDP server could accept an incorrect PDU type during authentication, while CVE-2026-72746 details a broader server-side authentication bypass where inbound PDUs are dispatched without proper verification of their type during the handshake. Both issues affect FreeRDP versions prior to 3.30.0 when RdstlsSecurity is set to TRUE.
The remaining two vulnerabilities, CVE-2026-73242 and CVE-2026-72745, are related to the Kerberos decryption process within the winpr library. Specifically, both CVEs point to a flaw in the kerberos_DecryptMessage function where the 16-bit EC field from a GSS Wrap token is used in pointer arithmetic without bounds-checking. This can lead to out-of-bounds memory access, potentially allowing a malicious RDP peer to trigger memory corruption. These issues also affect versions prior to 3.30.0.
The coordinated disclosure of these four High severity vulnerabilities on a single day emphasizes a significant security event for FreeRDP users. The patched version, 3.30.0, addresses all these issues, and users are strongly advised to update to this version to mitigate the risks associated with authentication bypass and out-of-bounds memory access vulnerabilities.
This batch of vulnerabilities underscores the need for continuous security vigilance in remote desktop solutions. By addressing these flaws, FreeRDP aims to maintain the integrity and security of its RDP implementation, protecting users from potential unauthorized access and data breaches.
Key Findings:
- Four High severity vulnerabilities were disclosed for FreeRDP on August 11, 2026.
- Two vulnerabilities relate to authentication bypass flaws in the RDSTLS handshake.
- Two vulnerabilities involve out-of-bounds memory access in the Kerberos decryption function.
- All disclosed vulnerabilities are fixed in FreeRDP version 3.30.0.
- The vulnerabilities impact FreeRDP versions prior to 3.30.0.
CVE IDs: CVE-2026-73242 CVE-2026-73241 CVE-2026-72746 CVE-2026-72745