This vulnerability is a double free in the WinPR Kerberos SSPI retrieveSomeTgt function in FreeRDP. An attacker can send a crafted NLA/CredSSP u2u TGT request where the server-name component contains an '@' character, causing the heap to be corrupted and the server process to crash. The vulnerability does not provide a direct execution path, but it can be used to deny service to legitimate clients.

Affected systems are installations of the FreeRDP client and server implementation before version 3.32.2. The product is FreeRDP, and the issue exists in any release before 3.32.2.

The CVSS score is 8.7, indicating high severity. Because the exploit is remote and does not require authentication, attackers can alter the heap and crash FreeRDP servers from the outside, causing denial of service. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is unauthenticated remote network traffic using the Kerberos SSPI protocol.