CVE-2026-121956 · Package
NO FIX YET · SEE WHAT TO DO
FreeRDP before 3.32.2 has a double free in the WinPR Kerberos SSPI code path that handles a crafted NLA/CredSSP u2u TGT request. An unauthenticated remote client can corrupt the heap and crash the server process.
first public Oct 20, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Systems running a FreeRDP-based RDP server before 3.32.2 with NLA/CredSSP reachable by remote clients. The sources describe a crash of the server process, not code execution, and do not say whether client-only use of FreeRDP is affected.
Not affected if fixed-version, no-rdp-server
Who cares freerdp, kerberos, rdp-server, winpr
xfreerdp --version or your package manager's query, and compare it to 3.32.2.3.32.2 or later.FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb5 default realm into a target principal that has an empty realm without taking ownership of it. Unauthenticated remote clients can send a crafted NLA/CredSSP u2u TGT request whose server-name component contains '@' to corrupt the heap and crash the server process.
This page as .md · .json · in your agent: get_signal("CVE-2026-121956") · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.