FreeRDP EUVD-2026-56935

Exploitation requires that the victim FreeRDP client or server is configured to use NLA/Kerberos authentication (CredSSP with Kerberos as the underlying SSPI mechanism), which is the default in enterprise Active Directory environments but may not be active in standalone or non-domain RDP setups. The attacker must control or impersonate the remote RDP endpoint the victim connects to, so as to inject a crafted GSS Wrap-token during the kerberos_DecryptMessage call - this implies either operating a rogue RDP server, intercepting an existing RDP session at the network layer, or compromising a legitimate RDP server. The CVSS AT:P (Attack Prerequisites Present) metric confirms additional attack-specific conditions beyond mere network reachability. Exploitation is not possible against RDP sessions using NTLM or certificate-only authentication, nor against any FreeRDP deployment where Kerberos/NLA is disabled. No authentication on the attacker's part (PR:N) is required, as the vulnerability fires before the Kerberos ticket exchange completes.

The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H) places the primary impact on availability with secondary low-confidence confidentiality and integrity leakage, consistent with a heap corruption that most reliably causes a crash but may be further exploitable with heap-layout control. AC:H and AT:P together signal that exploitation is non-trivial - it requires both the NLA/Kerberos authentication path to be active and careful crafting of EC/RRC values to trigger a useful memory corruption primitive rather than an immediate crash. No EPSS data was provided, but the absence of KEV listing and public POC code suggests exploitation has not been broadly attempted or is still in early research stages; even a mid-sized municipal IT team in walbrzych should treat this as urgent, since the vulnerability fires before authentication completes, limiting the effectiveness of access-control mitigations at the RDP session layer. The network-accessible, pre-auth location of the flaw in a widely-distributed RDP library elevates real-world priority beyond what the AC:H metric alone suggests, particularly for Linux environments using FreeRDP for enterprise RDP connectivity.

A threat actor operates a malicious RDP server (or performs a man-in-the-middle interception on an existing RDP connection) and waits for a FreeRDP client to connect using NLA/Kerberos authentication. During the CredSSP handshake, the attacker sends a GSS Wrap-token with an EC field value large enough that computing header + 16 + ec or header + 16 + rrc + ec exceeds the allocated sig_buffer boundary, causing kerberos_DecryptMessage to read from and write to adjacent heap memory. Reliable code execution would require additional heap-shaping primitives, but a denial-of-service crash is a straightforward outcome; no public proof-of-concept exploit code has been identified at time of analysis.