CVE-2026-33995: FreeRDP Use-After-Free Vulnerability

CVE-2026-33995 Overview

A double-free vulnerability has been identified in FreeRDP, the free implementation of the Remote Desktop Protocol. The flaw exists in the Kerberos authentication handling functions kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() within the WinPR library (winpr/libwinpr/sspi/Kerberos/kerberos.c). This vulnerability can cause FreeRDP clients to crash on systems where Kerberos and/or Kerberos U2U is configured, such as Samba AD member systems or systems using krb5 for NFS.

Critical Impact

FreeRDP clients on Kerberos-enabled systems may crash during NLA connection teardown following a failed authentication attempt, potentially causing denial of service conditions in enterprise environments.

Affected Products

• FreeRDP versions prior to 3.24.2
• Systems with Kerberos authentication configured (Samba AD members)
• Systems using krb5 for NFS

Discovery Timeline

• 2026-03-30 - CVE CVE-2026-33995 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-33995

Vulnerability Analysis

This double-free vulnerability (CWE-415) occurs in FreeRDP's Kerberos SSPI implementation. The issue manifests when memory allocated for security context handling is freed twice during the connection teardown process. Specifically, the vulnerability is triggered during Network Level Authentication (NLA) connection teardown when an authentication attempt has failed.

The root cause lies in improper handle invalidation ordering in the credentials and security context management code. When kerberos_FreeCredentialsHandle() is called, the code retrieves the credentials pointer and then attempts to free it, but fails to properly invalidate the secure handle before checking for null credentials. This creates a race condition where the same memory region can potentially be freed multiple times.

Root Cause

The vulnerability stems from incorrect ordering of security handle invalidation in the Kerberos SSPI credential handling code. The original implementation retrieved the lower pointer from the secure handle, checked for null, and only then invalidated the handle. This sequence allows for scenarios where the credentials memory is freed while the handle still references it, leading to a double-free condition when cleanup routines run during connection teardown after failed authentication.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction to trigger. An attacker could potentially exploit this vulnerability by:

1. Initiating a Remote Desktop connection to a target FreeRDP client
2. Configuring the connection to use Kerberos authentication
3. Causing the authentication to fail in a specific manner
4. Triggering the double-free condition during NLA connection teardown

The vulnerability requires that the target system has Kerberos authentication configured, which is common in enterprise environments using Active Directory or NFS with krb5.

// Security patch showing fix for handle invalidation ordering
// Source: https://github.com/FreeRDP/FreeRDP/commit/8078b8af1359055972e4fb2f509f543b69169391

// Before patch - incorrect ordering in kerberos.c:
{
#ifdef WITH_KRB5
	KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
	if (!credentials)
		return SEC_E_INVALID_HANDLE;

	credentials_unref(credentials);

	sspi_SecureHandleInvalidate(phCredential);  // Invalidation happens AFTER potential free
	return SEC_E_OK;
#else
	return SEC_E_UNSUPPORTED_FUNCTION;

// After patch - correct ordering:
{
#ifdef WITH_KRB5
	KRB_CREDENTIALS* credentials = sspi_SecureHandleGetLowerPointer(phCredential);
	sspi_SecureHandleInvalidate(phCredential);  // Invalidation happens IMMEDIATELY
	if (!credentials)
		return SEC_E_INVALID_HANDLE;

	credentials_unref(credentials);

	return SEC_E_OK;
#else
	return SEC_E_UNSUPPORTED_FUNCTION;

Detection Methods for CVE-2026-33995

Indicators of Compromise

• Unexpected FreeRDP client crashes during connection teardown
• Core dumps showing double-free conditions in kerberos.c or credssp.c
• Error logs indicating SEC_E_INVALID_HANDLE exceptions during NLA authentication
• Repeated connection failures with Kerberos-enabled RDP sessions

Detection Strategies

• Monitor FreeRDP client processes for abnormal termination signals (SIGABRT, SIGSEGV)
• Implement crash monitoring on systems running FreeRDP with Kerberos authentication
• Review system logs for patterns of failed NLA authentication followed by client crashes
• Deploy memory debugging tools (AddressSanitizer) in development/testing environments to detect double-free conditions

Monitoring Recommendations

• Enable verbose logging for FreeRDP clients to capture authentication failure sequences
• Configure alerting on repeated FreeRDP process crashes on Kerberos-enabled systems
• Monitor authentication logs on Samba AD domain controllers for suspicious connection patterns
• Track connection teardown events that follow failed authentication attempts

How to Mitigate CVE-2026-33995

Immediate Actions Required

• Upgrade FreeRDP to version 3.24.2 or later immediately
• Review and audit systems using Kerberos authentication with FreeRDP clients
• Consider temporarily disabling Kerberos authentication for FreeRDP if immediate patching is not possible
• Monitor affected systems for crash events until patches are applied

Patch Information

The vulnerability has been patched in FreeRDP version 3.24.2. The fix addresses the handle invalidation ordering issue by calling sspi_SecureHandleInvalidate() immediately after retrieving the pointer, before any null checks or memory operations. This ensures the handle is properly invalidated to prevent double-free scenarios.

For detailed patch information, refer to the GitHub FreeRDP Commit and the GitHub Security Advisory GHSA-mv25-f4p2-5mxx.

Workarounds

• Temporarily disable Kerberos authentication and use alternative authentication methods if patching is delayed
• Implement network segmentation to limit exposure of systems running vulnerable FreeRDP versions
• Configure connection retry limits to minimize impact of crashes on user experience
• Deploy application-level monitoring to automatically restart crashed FreeRDP client processes

# Configuration example - Check FreeRDP version and upgrade
# Check current version
xfreerdp --version

# On Debian/Ubuntu systems, upgrade FreeRDP
sudo apt update
sudo apt install freerdp2-x11

# Alternatively, build from patched source
git clone https://github.com/FreeRDP/FreeRDP.git
cd FreeRDP
git checkout 3.24.2
cmake -B build
cmake --build build
sudo cmake --install build