CVE-2026-121956
Description
A flaw was found in FreeRDP. A double-free memory vulnerability in the Kerberos authentication component allows an unauthenticated remote attacker to cause a Denial of Service (DoS). By sending a specially crafted Network Level Authentication (NLA) request, an attacker can corrupt server memory and cause the application process to crash.
Statement
This vulnerability is evaluated with an Important severity rating because an unauthenticated remote attacker can trigger a denial of service or heap corruption across the network before establishing credentials. In Red Hat enterprise environments, FreeRDP packages are primarily utilized as client-side software rather than listening services, which significantly reduces the exposed attack surface on typical installations. Exploitation specifically requires an active FreeRDP server or proxy configured with Kerberos authentication, an associated keytab, and an enabled user-to-user negotiation mechanism, limiting the likelihood of widespread exposure.
Mitigation
Restrict network exposure by limiting incoming connections to trusted IP addresses or networks using `firewalld`, or disable the listening RDP service if remote desktop access is not required.
To restrict RDP access to a trusted subnet using `firewalld`:
firewall-cmd --permanent --remove-service=rdp
firewall-cmd --permanent --zone=trusted --add-source=<trusted_ip_or_subnet>
firewall-cmd --reload
Warning: Reloading firewall rules may temporarily interrupt existing network sessions and will prevent incoming RDP connections originating from outside the designated trusted subnets.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to ensure proper memory ownership or duplication of default Kerberos realm strings within the WinPR Kerberos SSPI retrieveSomeTgt routine during target principal assignment: upgrade to FreeRDP 3.32.2 (or the fixed Freerdp builds), which duplicate or properly manage ownership of the default Kerberos realm string when assigning it to a realm-less target principal, closing crafted NLA/CredSSP u2u TGT request containing an '@' in the server-name component. Until patched, this is only a concern on FreeRDP servers or proxies configured with Kerberos authentication and user-to-user negotiation — Client-only FreeRDP installations or servers without Kerberos and u2u negotiation enabled are unaffected — so Restrict incoming network connections to the RDP listening port to trusted IP addresses using firewall rules, or disable the listening RDP service and user-to-user negotiation. These controls limit blast radius and contain exploitation, but they do not fix the underlying double-free defect — apply the upstream patch to fully remediate.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability,Integrity
Technical Impact: DoS: Crash, Exit, or Restart
Integrity
Technical Impact: Modify Memory; Modify Application Data
Depending on the type of resource and the expected API behavior, this could lead to memory corruption, data corruption, or execution path corruption.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
