CVE-2026-121956
Undergoing Analysis Undergoing Analysis - In Progress

Double Free in FreeRDP via NLA/CredSSP Request

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description
FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb5 default realm into a target principal that has an empty realm without taking ownership of it. Unauthenticated remote clients can send a crafted NLA/CredSSP u2u TGT request whose server-name component contains '@' to corrupt the heap and crash the server process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-121956
EUVD
EUVD-2026-116956

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-415 The product calls free() twice on the same memory address.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a double free vulnerability in FreeRDP's WinPR Kerberos SSPI implementation. It occurs when the retrieveSomeTgt function incorrectly handles memory for the krb5 default realm in a target principal with an empty realm. Unauthenticated remote clients can exploit this by sending a crafted NLA/CredSSP u2u TGT request with an '@' symbol in the server-name component, causing heap corruption and server crashes.

Detection Guidance

Detecting this vulnerability requires checking FreeRDP version and monitoring for crashes or heap corruption during NLA/CredSSP authentication attempts. Inspect logs for repeated crashes in FreeRDP processes. Use network monitoring tools to detect malformed NLA/CredSSP tokens with '@' symbols in server-name fields.

Impact Analysis

The vulnerability allows unauthenticated remote attackers to crash FreeRDP server processes repeatedly by sending specially crafted requests. This can lead to denial-of-service conditions, disrupting services that rely on FreeRDP for remote desktop access. If exploited further, it may enable additional attacks through heap manipulation.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.2 or later immediately. Disable Kerberos authentication in FreeRDP if not required. Block external connections to FreeRDP ports until patched. Monitor for exploitation attempts in authentication logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121956. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...