This is a memory corruption vulnerability in FreeRDP's CredSSP/Kerberos implementation. The EC field from the GSS Wrap token is used directly as an IOV offset without any bounds validation, allowing a malicious RDP server to write to arbitrary memory locations during the NLA handshake that is supposed to protect the client.
The vulnerable code sits in the kerberos_DecryptMessage function within FreeRDP's WinPR library. A peer-controlled field becomes a memory address offset with no range check — this is not a subtle logic flaw, it's a straightforward failure to validate untrusted input before using it as a pointer.
The fix shipped in FreeRDP 3.30.0. If you're running any FreeRDP derivative or an RDP gateway relying on NLA, you need that version. But the deeper concern is the pattern: this is the third IOV-based pointer arithmetic vulnerability in FreeRDP's cryptographic paths in four years, following CVE-2020-11035 (NTLM) and CVE-2020-11099 (TLS). Each instance got a one-line bounds check added locally. None addressed the underlying abstraction. The dangerous IOV interface persists because refactoring it would break API compatibility with downstream consumers, so the codebase accumulates defensive band-aids on a wound that keeps reopening.
The structural irony is sharp: Network Level Authentication exists to protect clients from rogue servers, but this vulnerability makes the NLA Kerberos handling itself the attack surface. A compromised RDP server exploits the authentication mechanism that clients trust to protect them. Anyone who deployed an RDP gateway protected by NLA was relying on this code to be trustworthy, and it wasn't.
The WinPR library's blast radius compounds this. It's consumed beyond FreeRDP itself — by custom RDP implementations, security tools, and auditing platforms. Every fork that pulled WinPR before this fix carries undisclosed vulnerability debt they may not know exists.
Your immediate action: deploy FreeRDP 3.30.0 or later. Your longer-term concern: IOV interfaces expose raw pointer arithmetic to application logic, making bounds validation someone else's problem by default. Until the WinPR library enforces bounds semantics at the abstraction layer rather than relying on each call site to get it right, you'll be patching this class of bug in the next cryptographic protocol FreeRDP adds.