The vulnerability arises from the Kerberos wrapper token EC field not being bounded before it is used for IOV pointer offsets in the kerberos_DecryptMessage routine. This flaw permits a malicious RDP peer to generate a wrap token that contains an EC value larger than any allocated buffer. When the function processes such a token, it performs out‑of‑bounds reads and in‑place writes, potentially corrupting memory or executing arbitrary code. The weakness is a classic out‑of‑bounds read/write, classified as CWE‑122 and CWE‑125, and can be abused to compromise the integrity or confidentiality of the server process.

FreeRDP before version 3.30.0 is affected. Any FreeRDP instance not upgraded to 3.30.0 or newer is vulnerable to the unbounded EC field flaw. The issue was fixed in the 3.30.0 release and later versions.

The vulnerability carries a CVSS score of 8.3, indicating high severity. The EPSS score is below 1 %, pointing to a low exploitation probability at the time of this analysis, and it is not listed in CISA’s KEV catalog. Successful exploitation requires an attacker to act as an RDP peer that transmits a crafted Kerberos token to a vulnerable FreeRDP server, utilizing the CredSSP/NLA authentication flow. If the attack succeeds, the attacker can alter memory on the server, potentially leading to remote code execution or privilege escalation.