Nixpkgs Security Tracker

Login with GitHub

Details of issue NIXPKGS-2026-0882

NIXPKGS-2026-0882
published on 31 Mar 2026
Permalink CVE-2026-33995
5.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): LOW
updated 15 hours ago by @mweinelt Activity log
  • Created automatic suggestion 1 day ago
  • @mweinelt accepted 16 hours ago
  • @mweinelt published on GitHub 15 hours ago
FreeRDP: Possible double free in kerberos_AcceptSecurityContext

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a double-free vulnerability in kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() (WinPR, winpr/libwinpr/sspi/Kerberos/kerberos.c) can cause a crash in any FreeRDP clients on systems where Kerberos and/or Kerberos U2U is configured (Samba AD member, or krb5 for NFS). The crash is triggered during NLA connection teardown and requires a failed authentication attempt. This issue has been patched in version 3.24.2.

References

Affected products

FreeRDP
  • ==< 3.24.2

Matching in nixpkgs

Package maintainers

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mv25-f4p2-5mxx