Double-Free Vulnerability in FreeRDP Kerberos Causes Client Crash

Publication date: 2026-03-30

Last updated on: 2026-04-01

Assigner: GitHub, Inc.

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a double-free vulnerability in kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() (WinPR, winpr/libwinpr/sspi/Kerberos/kerberos.c) can cause a crash in any FreeRDP clients on systems where Kerberos and/or Kerberos U2U is configured (Samba AD member, or krb5 for NFS). The crash is triggered during NLA connection teardown and requires a failed authentication attempt. This issue has been patched in version 3.24.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-30

Last Modified

2026-04-01

Generated

2026-07-06

AI Q&A

2026-03-31

EPSS Evaluated

2026-07-05

NVD

CVE-2026-33995

Affected Vendors & Products

Vendor	Product	Version / Range
freerdp	freerdp	to 3.24.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-415	The product calls free() twice on the same memory address.

Attack-Flow Graph

Executive Summary

This vulnerability is a double-free issue in FreeRDP versions prior to 3.24.2. It occurs in the kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() functions within the Kerberos implementation. When a failed authentication attempt happens during Network Level Authentication (NLA) connection teardown on systems configured with Kerberos or Kerberos U2U (such as Samba AD members or krb5 for NFS), the double-free can cause the FreeRDP client to crash.

Impact Analysis

The primary impact of this vulnerability is that it can cause a crash (denial of service) in FreeRDP clients on affected systems. This crash happens during connection teardown after a failed authentication attempt, potentially disrupting remote desktop sessions and causing service interruptions.

Mitigation Strategies

To mitigate this vulnerability, update FreeRDP to version 3.24.2 or later, where the double-free issue in kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() has been patched.

Hi! I’m here to help you understand CVE-2026-33995. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70