The vulnerability in FreeRDP before version 3.30.0 is due to improper bounds checking of the 16-bit EC (extra count) field in the kerberos_DecryptMessage() function. This field is used directly in pointer arithmetic to locate encrypted regions within a GSS Wrap token, but only the RRC and total buffer length are validated. By supplying a large EC value (up to 0xFFFF), a malicious peer can cause the decrypt operation's base pointers to move past the end of the approximately 60-byte token buffer. Since AES-CTS-HMAC enctypes decrypt in place before the HMAC integrity check, this results in an out-of-bounds read and write, potentially causing information disclosure, memory corruption, or denial of service.

Successful exploitation allows a malicious peer (server or client) to cause out-of-bounds memory reads and writes during authentication, which can lead to information disclosure or memory corruption. This can compromise the confidentiality and integrity of the affected system. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects FreeRDP versions before 3.30.0, upgrading to version 3.30.0 or later is expected to address the issue once an official fix is released. Until then, avoid untrusted peers during CredSSP/NLA authentication to reduce risk.