CVE-2026-121956: FreeRDP before 3.32.2 Double Free in WinPR Kerberos retrieveSomeTgt

Q: Which systems are exposed to this issue?

Systems using affected FreeRDP packages, including the listed debian/freerdp3 and debian/freerdp2 software entries, may be exposed when they accept NLA/CredSSP connections that reach the WinPR Kerberos SSPI code path.

Q: Does an attacker need credentials or user interaction to trigger the issue?

No. The vulnerability is reachable by an unauthenticated remote client, and the supplied vector requires neither privileges nor user interaction.

Q: What is the practical impact of exploitation?

A crafted NLA/CredSSP u2u TGT request with an '@' in the server-name component can corrupt heap memory and crash the server process, resulting in a denial of service.

Q: What version resolves the vulnerability?

FreeRDP 3.32.2 resolves the issue; versions before 3.32.2 are affected according to the available data.

Published Nov 4, 2026

Updated

FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb5 default realm into a target principal that has an empty realm without taking ownership of it. Unauthenticated remote clients can send a crafted NLA/CredSSP u2u TGT request whose server-name component contains '@' to corrupt the heap and crash the server process.

Affected Software

5 affected componentsFixes available

debian/freerdp2*

debian/freerdp3*

debian/freerdp3<3.32.2+dfsg-1

3.32.2+dfsg-1

debian/freerdp2<=2.11.7+dfsg1-6~deb12u1

debian/freerdp3<=3.15.0+dfsg-2.1+deb13u3

3.32.2+dfsg-13.33.0+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1
Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.32.2

Event History

Nov 4, 2026

CVE Published

via MITRE·03:33 PM

Data Sourced

via MITRE·03:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

Systems using affected FreeRDP packages, including the listed debian/freerdp3 and debian/freerdp2 software entries, may be exposed when they accept NLA/CredSSP connections that reach the WinPR Kerberos SSPI code path.

Does an attacker need credentials or user interaction to trigger the issue?

No. The vulnerability is reachable by an unauthenticated remote client, and the supplied vector requires neither privileges nor user interaction.

What is the practical impact of exploitation?

A crafted NLA/CredSSP u2u TGT request with an '@' in the server-name component can corrupt heap memory and crash the server process, resulting in a denial of service.

What version resolves the vulnerability?

FreeRDP 3.32.2 resolves the issue; versions before 3.32.2 are affected according to the available data.

CVE-2026-121956: FreeRDP before 3.32.2 Double Free in WinPR Kerberos retrieveSomeTgt

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

Does an attacker need credentials or user interaction to trigger the issue?

What is the practical impact of exploitation?

What version resolves the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

Does an attacker need credentials or user interaction to trigger the issue?

What is the practical impact of exploitation?

What version resolves the vulnerability?