CVE-2026-73242

A flaw in FreeRDP's Kerberos implementation allows a malicious RDP peer to cause an out-of-bounds memory access by providing an unbounded GSS Wrap-token EC field. This occurs during CredSSP/NLA decryption and can lead to a denial of service or information disclosure. Mitigation Use FreeRDP with...

JLSEC-2026-1258 In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application...

In MIT Kerberos 5 aka krb5 before 1.22.3, there is a NULL pointer dereference if an application calls gssacceptseccontext on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parsenegomessage...

CVE-2026-71407

A Stack-based Buffer Overflow vulnerability CWE-121 vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands in the context of the WAD daemon via crafted sockets, only if the explicit...

CVE-2026-71407

CVE-2026-71407 is a stack-based buffer overflow (CWE-121) in the WAD daemon of Fortinet FortiOS 7.6.1 through 7.6.6 . An unauthenticated attacker who can bypass stack protection and ASLR may execute arbitrary code or commands via crafted sockets, but only if the explicit proxy is configured with ...

EUVD-2026-57191

A Stack-based Buffer Overflow vulnerability CWE-121 vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands in the context of the WAD daemon via crafted sockets, only if the explicit...

CVE-2026-71407

A Stack-based Buffer Overflow vulnerability CWE-121 vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an unauthenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands in the context of the WAD daemon via crafted sockets, only if the explicit...

PT-2026-71065

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions 7.6.1 through 7.6.6 Description A stack-based buffer overflow occurs in the WAD daemon when the explicit proxy is configured with Kerberos authentication and SOCKS enabled. An unauthenticated attacker can exploit this...

Linux Distros Unpatched Vulnerability : CVE-2026-73242

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberosDecryptMessage...

Stack buffer overflow in WAD

...

Fortinet Fortigate Stack buffer overflow in WAD (FG-IR-26-161)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-161 advisory. - A Stack-based Buffer Overflow vulnerability CWE-121 vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an...

CVE-2026-73242

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberosDecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP...

UBUNTU-CVE-2026-73242

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberosDecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP...

CVE-2026-73242

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberosDecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP...

CVE-2026-73242 FreeRDP: Kerberos GSS Wrap-token `EC` field is unbounded, causing an out-of-bounds decrypt in `kerberos_DecryptMessage`

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberosDecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP...

CVE-2026-73242

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberosDecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP...

CVE-2026-73242

FreeRDP prior to version 3.30.0 is affected. The vulnerability resides in winpr/libwinpr/sspi/Kerberos/kerberos.c within kerberos_DecryptMessage, where the peer-controlled GSS Wrap-token EC field is not bounded before use with RRC in IOV pointer offsets, enabling out-of-bounds reads and in-place ...

CVE-2026-73242

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberosDecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP...

CVE-2026-73242 FreeRDP: Kerberos GSS Wrap-token `EC` field is unbounded, causing an out-of-bounds decrypt in `kerberos_DecryptMessage`

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberosDecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP...

CVE-2026-73242 FreeRDP: Kerberos GSS Wrap-token `EC` field is unbounded, causing an out-of-bounds decrypt in `kerberos_DecryptMessage`

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberosDecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP...

EUVD-2026-56935

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberosDecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP...