A double‑free bug exists in the Kerberos authentication handling of FreeRDP clients prior to version 3.24.2. When the NLA connection is torn down after a failed authentication attempt, the library frees the same memory twice, causing the client to crash. This crash results in a denial of service on the affected systems, as the RDP session is abruptly terminated. The weakness is identified as CWE‑415 (Double Free) and CWE‑825 (Incomplete Validation of Memory Management).

All FreeRDP installations using the free implementation of the Remote Desktop Protocol, specifically versions older than 3.24.2, are vulnerable on systems configured with Kerberos or Kerberos U2U such as Samba AD members or clients using krb5 for NFS. The issue arises in the kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() functions located in winpr/libwinpr/sspi/Kerberos/kerberos.c.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, requiring an attacker to initiate an RDP session and force a failed authentication that triggers the double‑free during teardown. Exploitability does not gain elevated privilege or confidentiality, but the crash can be used to disrupt connectivity for legitimate users.