GHSA-2557-79qc-6gfr: FreeRDP before 3.32.2 Double Free in WinPR Kerberos retrieveSomeTgt

Published Nov 4, 2026

Updated

FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb5 default realm into a target principal that has an empty realm without taking ownership of it. Unauthenticated remote clients can send a crafted NLA/CredSSP u2u TGT request whose server-name component contains '@' to corrupt the heap and crash the server process.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.32.2

Event History

Nov 4, 2026

CVE Published

via OSV·03:33 PM

Data Sourced

via OSV·03:33 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which systems are exposed to this issue?

Servers using affected FreeRDP versions before 3.32.2 are exposed when they accept NLA/CredSSP u2u TGT requests. The vulnerable code is in the WinPR Kerberos SSPI retrieveSomeTgt function.

Does an attacker need credentials or user interaction?

No. The issue can be triggered by an unauthenticated remote client, and the supplied vector indicates no privileges or user interaction are required.

What must an attacker send to trigger the flaw?

The attacker must send a crafted NLA/CredSSP u2u TGT request with an '@' character in the server-name component. This causes the affected code path to corrupt heap memory through a double free.

What is the confirmed impact?

The documented impact is heap corruption that can crash the server process, resulting in a denial of service. The provided data does not establish confidentiality or integrity impact.

GHSA-2557-79qc-6gfr: FreeRDP before 3.32.2 Double Free in WinPR Kerberos retrieveSomeTgt

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

Does an attacker need credentials or user interaction?

What must an attacker send to trigger the flaw?

What is the confirmed impact?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

Does an attacker need credentials or user interaction?

What must an attacker send to trigger the flaw?

What is the confirmed impact?