CVE-2026-33995: 
NixOS vulnerability analysis and mitigation

CVE-2026-33995 is a double-free vulnerability in FreeRDP's Kerberos SSPI authentication functions (kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA()) located in winpr/libwinpr/sspi/Kerberos/kerberos.c. It affects all FreeRDP versions prior to 3.24.2 compiled with Kerberos support (WITH_KRB5=ON) on systems configured with a Kerberos realm (e.g., Samba AD members or systems using krb5 for NFS). The vulnerability was published on March 30, 2026, and patched in version 3.24.2. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a heap double-free (CWE-415) combined with an expired pointer dereference (CWE-825) in the Kerberos SSPI context cleanup path of WinPR. When kerberos_AcceptSecurityContext() or kerberos_InitializeSecurityContextA() fails after at least one successful call, kerberos_ContextFree() is invoked to release the allocated context; however, the PCtxtHandle pointer is not immediately invalidated via sspi_SecureHandleInvalidate(), leaving it pointing to already-freed memory. On subsequent calls or during NLA connection teardown, the stale handle is dereferenced and freed again, causing a crash. The fix (commit 8078b8a) ensures sspi_SecureHandleInvalidate() is called immediately after freeing the context across all affected SSPI providers (GitHub Advisory, GitHub Commit).

Successful exploitation causes a crash (denial of service) in any FreeRDP-based RDP client — including xfreerdp, wlfreerdp, sdl-freerdp, gnome-connections, remmina, and FreeRDP-Proxy — on Kerberos-configured systems. There is no confidentiality or integrity impact; the sole consequence is availability loss (client crash) triggered during NLA connection teardown following a failed authentication attempt. An unauthenticated remote attacker can trigger this condition without user interaction by causing a failed Kerberos authentication exchange (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires the target system to have Kerberos authentication configured and a failed authentication attempt to trigger the crash, limiting the attack surface to Kerberos-enabled deployments. The EPSS score is approximately 0.057%, reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify systems running FreeRDP clients (versions < 3.24.2) compiled with WITH_KRB5=ON on networks where Kerberos authentication is configured (e.g., Samba AD environments or NFS with krb5).
2. Initiate RDP connection: Establish or intercept an RDP connection attempt from the target FreeRDP client to an RDP server, triggering NLA (Network Level Authentication) negotiation.
3. Cause authentication failure: Provide invalid credentials or manipulate the Kerberos exchange to cause kerberos_AcceptSecurityContext() or kerberos_InitializeSecurityContextA() to fail after at least one successful internal call, ensuring the PCtxtHandle is already set to a previously freed value.
4. Trigger double-free: During NLA connection teardown, the stale PCtxtHandle is passed to kerberos_ContextFree() a second time, triggering the heap double-free and crashing the FreeRDP client process (GitHub Advisory, GitHub Commit).

• Logs: Unexpected FreeRDP client crash logs or core dumps referencing kerberos_AcceptSecurityContext, kerberos_InitializeSecurityContextA, or kerberos_ContextFree in stack traces; Kerberos authentication failure events in system logs (e.g., /var/log/krb5kdc.log or Samba AD logs) coinciding with client crashes.
• Process: Abnormal termination (SIGABRT or SIGSEGV) of FreeRDP client processes (xfreerdp, wlfreerdp, sdl-freerdp) during or immediately after RDP connection attempts; heap corruption detection messages from memory allocators (e.g., glibc double free or corruption errors).
• Network: Repeated failed NLA/Kerberos authentication attempts from the same source IP to RDP endpoints, particularly if followed by abrupt connection termination (GitHub Advisory).

Upgrade FreeRDP to version 3.24.2 or later, which contains the fix introduced in commit 8078b8a (GitHub Commit). Downstream distributions including Fedora, openSUSE, Amazon Linux 2023, and Debian have issued updated packages. For environments where immediate patching is not feasible, consider disabling Kerberos authentication (WITH_KRB5=OFF at build time or by removing Kerberos configuration) if alternative authentication methods are available, and restrict network access to RDP services to trusted hosts (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported by researcher prahal and credited in the GitHub Security Advisory. A user-facing report was filed on the GNOME Discourse forum (https://discourse.gnome.org/t/still-can-no-longer-login-to-gnome-remote-desktop/34451), indicating real-world impact on GNOME Remote Desktop users. Red Hat, openSUSE, Amazon Linux, and Debian have all issued security updates addressing this and related FreeRDP vulnerabilities, reflecting broad downstream attention (GitHub Advisory, Red Hat Bugzilla).