CVE-2026-121956 in FreeRDP
Summary
by MITRE • 11/04/2026
FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb5 default realm into a target principal that has an empty realm without taking ownership of it. Unauthenticated remote clients can send a crafted NLA/CredSSP u2u TGT request whose server-name component contains '@' to corrupt the heap and crash the server process.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in FreeRDP versions prior to 3.32.2 represents a critical memory management flaw located within the WinPR Kerberos SSPI implementation, specifically affecting the retrieveSomeTgt function. This component is responsible for handling authentication requests and managing Ticket Granting Tickets (TGTs) during network level authentication or CredSSP sessions. The core technical deficiency arises from an improper ownership transfer mechanism when processing realm information. When a target principal with an empty realm string is processed, the system attempts to install the krb5 default realm into this structure without correctly assuming ownership of the memory allocated for that string. This oversight leads directly to a double free condition, where the same block of heap memory is deallocated twice during the cleanup process after authentication handling completes or fails.
From an operational perspective, this flaw allows unauthenticated remote attackers to trigger a denial of service against FreeRDP servers and services relying on Kerberos-based authentication mechanisms such as NLA or CredSSP with user-to-user (u2u) TGT requests. By crafting a malicious request where the server-name component contains specific characters like the at symbol, an attacker can manipulate the internal state of the memory allocator to execute the double free sequence. The immediate consequence is heap corruption, which typically results in the abrupt termination or crash of the FreeRDP process. While primarily observed as a denial-of-service vector due to the instability caused by memory corruption, such low-level memory errors often present secondary risks including potential information disclosure if the attacker can control subsequent allocations that overwrite sensitive data structures before the application terminates.
This vulnerability aligns with CWE-415, which describes Double Free vulnerabilities where an object is freed more than once, leading to undefined behavior and system instability. It also relates closely to CWE-787, as improper pointer handling in this context can lead out-of-bounds writes or reads during the corrupted heap state. In terms of adversary tactics, this flaw supports ATT&CK technique T1499, Endpoint Denial of Service, where attackers exploit software vulnerabilities to disrupt availability rather than compromising confidentiality or integrity directly. The exploitation path involves sending crafted network packets that trigger the vulnerable code path within the authentication subsystem without requiring prior valid credentials, highlighting a significant gap in input validation and resource management for untrusted remote inputs.
Mitigation strategies must prioritize immediate patching of all FreeRDP installations to version 3.32.2 or later where this ownership logic has been corrected to ensure proper memory lifecycle management. For environments unable to update immediately, network-level controls should be implemented to restrict access to the RDP service ports from untrusted networks and enforce strict firewall rules limiting connections to known IP ranges. Additionally, deploying intrusion detection systems capable of identifying anomalous Kerberos or CredSSP packet structures may help mitigate exploitation attempts by blocking malformed requests before they reach the vulnerable application logic. Regular auditing of authentication configurations and ensuring that default realm settings are appropriately configured can further reduce the attack surface associated with this specific code path.