Bug 2513936 (CVE-2026-72745)

Summary: CVE-2026-72745 FreeRDP: FreeRDP: Information disclosure and memory corruption via malformed Kerberos GSS Wrap token
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerability-draftAssignee: Product Security <prodsec-ir-bot>
Status: CLOSED DUPLICATE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: gnaik, rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in FreeRDP. A malicious peer, either a server or client, can exploit an out-of-bounds vulnerability during CredSSP/NLA authentication. By supplying a large 'extra count' (EC) value in a Kerberos GSS Wrap token, an attacker can cause the decryption operation to access memory outside of its intended buffer. This can lead to information disclosure, memory corruption, or a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2026-08-18 17:55:00 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2513974, 2513975    
Bug Blocks:    

Description OSIDB Bzimport 2026-08-11 12:21:49 UTC 
FreeRDP before 3.30.0 contains an out-of-bounds vulnerability in kerberos_DecryptMessage() (winpr/libwinpr/sspi/Kerberos/kerberos.c). The 16-bit EC (extra count) field of a peer-supplied GSS Wrap token (RFC 4121) is used directly in pointer arithmetic to locate the encrypted regions without being bounds-checked, while only RRC and the total buffer length are validated. A malicious peer (server or client) can supply a large EC value (up to 0xFFFF) during CredSSP/NLA authentication, moving the decrypt operation's base pointers past the end of the ~60-byte token buffer. Because the AES-CTS-HMAC enctypes decrypt in place before the HMAC integrity check, this results in an out-of-bounds read and in-place out-of-bounds write, potentially leading to information disclosure, memory corruption, or denial of service.
Comment 2 Ganesh 2026-08-18 17:55:00 UTC 

*** This bug has been marked as a duplicate of bug 2514346 ***