CVE-2026-121956

high

FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb5 default realm into a target principal…

FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb5 default realm into a target principal that has an empty realm without taking ownership of it. Unauthenticated remote clients can send a crafted NLA/CredSSP u2u TGT request whose server-name component contains '@' to corrupt the heap and crash the server process.

CVSS

7.5

7.5 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Severity source: NVD CVSS v3.1 (disclosure@vulncheck.com)

Timeline (UTC)

Published: 2026-11-04 16:17

Modified: 2026-11-04 19:17

NVD status: Undergoing Analysis

Last synced 7 hours ago

Verified against the source API 2026-11-04 19:35 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

Not reported by the source (unknown — not "none").

Weakness classification (CWE)

CWE-415

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

No vendor advisory or patch reference tagged by NVD. Check the references below.

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2557-79qc-6gfr disclosure@vulncheck.com
https://www.vulncheck.com/advisories/freerdp-before-3.32.2-double-free-in-winpr-kerberos-r... disclosure@vulncheck.com
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2557-79qc-6gfr 134c704f-9b21-4f2e-91b3-4a467353bcc0

Data sources

NVD CVE API 2.0 — fetched 2026-11-04 19:35 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores