PT-2026-137008

CVE-2026-121956

Published

2026-10-12

Updated

2026-11-04

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.2

Description A double free occurs in the WinPR Kerberos SSPI retrieveSomeTgt() function. This happens when the krb5 default realm is installed into a target principal that has an empty realm without taking ownership of it. Unauthenticated remote clients can trigger this by sending a crafted NLA/CredSSP u2u TGT request where the server-name component contains the '@' character, leading to heap corruption and a crash of the server process.

Recommendations Update to version 3.32.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Keensecuritylab

Smaeljaish771

Vendors

Affected products

Weakness enumeration

CWE-415: Double Free