FreeRDP versions prior to 3.30.0 contain an out‑of‑bounds read and write flaw within the kerberos_DecryptMessage function. The 16‑bit EC (extra count) field in a Kerberos GSS Wrap token is used without bounds checking to calculate pointers for decrypting the token. A malicious peer can supply a large EC value during CredSSP/NLA authentication, moving the computation past the end of the underlying ~60‑byte buffer. This causes the decryption routine to read and write beyond the buffer, potentially leaking sensitive data, corrupting memory, or causing a denial of service.

Any installation of FreeRDP that uses a version older than 3.30.0 is vulnerable. This includes both client and server components that participate in Kerberos‑based CredSSP or NLA authentication flows. User‑controlled client applications and remote desktop servers that rely on FreeRDP without updating can be targeted.

The flaw carries a CVSS score of 8.7, indicating high severity. While an EPSS estimate is not available, the vulnerability is not listed in the CISA KEV catalog, but the lack of listing does not reduce its potential risk, especially because the attack requires only a specially crafted Kerberos token during normal authentication traffic. An attacker can target any remote session established with a vulnerable FreeRDP instance, and success would result in information disclosure or memory corruption without needing any elevated privileges on the host.