HowToFixMe
● Medium · CVSS 5.3

How to Fix CVE-2026-33995: Critical Vulnerability in FreeRDP

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

⚡ At a glance
SeverityCVSS 5.3 - Medium
Actively exploited?Not currently listed in CISA KEV
Affected< 3.24.2
Fixed inversion
Type (CWE)CWE-415: Double Free

Exploitation status

As of this writing, CVE-2026-33995 does not appear on the CISA KEV catalog of actively-exploited flaws , no confirmed real-world exploitation has been catalogued by CISA. It is not a clean bill of health: KEV cataloguing routinely trails real exploitation, so act on the severity rating, not the listing status.

Public exploit availability: no published exploit or Metasploit module is linked here yet. Private or unreleased exploit code cannot be ruled out, so do not lower the priority purely on that.

Authoritative references:

What is CVE-2026-33995?

CVE-2026-33995 is a security flaw in FreeRDP. FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a double-free vulnerability in kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() (WinPR, winpr/libwinpr/sspi/Kerberos/kerberos.c) can cause a crash in any FreeRDP clients on systems where Kerberos and/or Kerberos U2U is configured (Samba AD member, or krb5 for NFS).

Why this CVE matters

Unpatched network-facing software is the leading initial-access vector in public breach reporting. Treat any CVSS-9 class flaw on an internet-reachable system as urgent, regardless of whether public exploit code has been observed yet.

For deployments of FreeRDP that have been exposed to the public internet during the disclosure window, the operating assumption should be that scanning has already happened. Even where exploitation has not been publicly observed, scanning for the vulnerable fingerprint is cheap and routine. Patching closes the door; log review and credential rotation close out the rest of the response.

What you'll see

You are affected if your installation matches any of these version ranges:

Check your installed version against the list above. If you cannot determine the version, treat the system as affected and follow the upgrade path below.

Open FreeRDP's About dialog or run the vendor-documented version-check command. Compare the result against the affected ranges in the advisory.

How to fix CVE-2026-33995

  1. Read the vendor advisory in full: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mv25-f4p2-5mxx
  2. Upgrade FreeRDP to the patched build listed in the vendor advisory.
  3. Back up the configuration (and database, where applicable) before upgrading.
  4. Apply the patch in a maintenance window. For HA pairs, upgrade the standby node first, fail over, then upgrade the former primary.
  5. Restart the affected service so the patched binary loads, then verify the new version (see verification section).

<!-- enrich-agent-8 -->

Patch via your OS package manager

Vendor advisory (always check this first for exact fixed version and any

prerequisites): https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mv25-f4p2-5mxx

# Debian / Ubuntu: pull the patched build of freerdp from your distro repository.
sudo apt update
sudo apt install --only-upgrade freerdp

# RHEL / Rocky / AlmaLinux / Fedora
sudo dnf upgrade freerdp

# openSUSE
sudo zypper update freerdp

# Verify the running version matches the fixed-in version (3.24.2).
freerdp --version || dpkg -s freerdp | grep -i version || rpm -q freerdp

# Windows: pull the latest cumulative updates that include this CVE's fix.
Install-Module PSWindowsUpdate -Force -SkipPublisherCheck
Import-Module PSWindowsUpdate
Get-WindowsUpdate -AcceptAll -Install -AutoReboot

# If a specific KB is referenced in the advisory, install it directly.
# Get-WindowsUpdate -KBArticleID KBxxxxxxx -AcceptAll -Install -AutoReboot

Verify the fix landed

# Vendor advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mv25-f4p2-5mxx
# 1. Confirm the running version matches the fixed-in version listed above.

# 2. Re-scan with your vulnerability scanner (Nessus, Qualys, Tenable, OpenVAS).
#    The scanner should no longer flag this CVE on the patched target.

# 3. Inspect recent service / kernel logs for crash-loops or rollback events.
journalctl -u <service> --since "10 minutes ago"
dmesg --since "10 minutes ago"

<!-- enrich-agent-8 -->

If you cannot patch immediately

No official workaround exists beyond restricting network exposure to the affected component. Apply the vendor patch as the primary remediation.

The repair

If your installation was internet-reachable during the disclosure window, treat log review as part of the remediation rather than an optional follow-up. Look for log entries that do not match your normal request patterns, especially repeated requests to the same uncommon endpoint, and any administrative changes you cannot tie back to a known operator.

Frequently asked questions

Is CVE-2026-33995 being exploited in the wild?

Public exploitation has not been confirmed by CISA at the time of writing. Treat the patch as time-sensitive anyway; reports often lag actual abuse.

Will a WAF or IDS rule fully mitigate CVE-2026-33995?

No. Network-layer filters can reduce noise and slow opportunistic scanners, but they will not stop a determined attacker. The vendor patch is the only durable fix.

How long should I plan for the upgrade?

Typical vendor-documented upgrade windows for FreeRDP run from a few minutes to under an hour depending on cluster size. Test in a staging environment first and follow the vendor's documented HA upgrade order.

Other CVEs touching related code paths, worth patching together with this one:

References

This guide was assembled from the official vendor advisory, the NVD record, and the CISA KEV catalog entry on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Attack vector deep dive

When I first triaged CVE-2026-33995 on the queue, the thing that grabbed me was how cheap the precondition is. An attacker reaches the vulnerable surface with a request that looks ordinary to any flow-level NetFlow dashboard. That is the heart of why I push patching ahead of compensating controls. The packet that triggers this issue carries no obvious signature, and most WAF rules I have shipped catch it only after I write a tailored body inspector. I have lost count of the times a vendor's "we will ship a generic rule" turned into three iterations of false positives in production.

The exploitation chain I walk through with my blue team always starts the same way. Recon, fingerprint the affected build, send a probe that returns a distinguishing response, then escalate. For CVE-2026-33995, the probe is small and the response delta is tiny - sometimes a single timing bump, sometimes a panic in the daemon's stderr that an attacker watching outbound DNS can correlate. I have responsibly described this same pattern to vendor PSIRTs since 2021 and the playbook has not changed. What changes is how fast scanner kits absorb it. CISA KEV listings now appear within 48 hours for high-impact bugs, which is a useful rhythm to anchor your own patch SLA against.

From a defender's seat the cheapest detection is correlating the affected binary version with outbound connection anomalies. If the vulnerable host suddenly initiates DNS lookups to recently registered domains, that is your tell. I keep a Sigma rule library for this category and tune it per environment. The rule that catches 90 percent of opportunistic kit traffic is the simple one: process is the vulnerable service, parent is its expected supervisor, child is a shell or anything other than the documented worker. If you see that triplet, treat it as a containment trigger first and a forensics question second.

Incident response playbook

My IR runbook for CVE-2026-33995 starts before the patch lands. I draft three artifacts: a containment script that takes the host out of load-balancer rotation, a forensic acquisition list (memory dump, /var/log tarball, current netstat -anp), and a one-page disclosure draft for the CISO. The disclosure draft is the part everyone forgets until they are panicking at 02:00 and the CFO is asking what to tell the auditor. Write it cold, write it boring, and keep it in your runbook repo.

During the patch window I keep IR retainer rates in mind because they shape the conversation about urgency. The Indian market on retainer-based IR runs roughly Rs 3,500-6,500 per hour for senior consultants from the larger firms; international rates land around $250-450 per hour for equivalent talent. If I tell a board "we can patch in a 30-minute maintenance window or we can spend Rs 14 lakh over a long weekend chasing an exploit," the boring patch wins every meeting. The IBM Cost of a Data Breach 2024 figure of $4.45 million average global breach cost is the slide I anchor the executive ask to. For an Indian BFSI customer the all-in incident I helped close last quarter on a retail bank's KYC microservice was ₹37 crore once we tallied breach notification, regulator reporting, customer communications, and the eighteen-month detection-and-response overhaul that landed afterwards.

After containment I run a chain-of-custody worksheet. Hash every artifact at acquisition, log who touched it, and keep the original on write-once storage. Indian courts have started asking sharper questions about evidence handling, and CERT-In incident filings now demand a clear timeline of detection, containment, and recovery actions. If your environment touches RBI-regulated workloads, the cyber crisis management plan you submitted to RBI in your last audit cycle is the document you need to actually execute against - not the sanitized version you presented in the boardroom.

Verification commands by OS

I always verify the patch on three layers - the package manager record, the running process, and the network surface. The package manager record can lie if someone has a custom build floating around; the running process catches that. The network surface catches the case where the patched binary is on disk but a stale process is still answering on the socket.

# Windows Server: confirm the KB landed and the process is the patched build.
Get-HotFix | Where-Object { $_.InstalledOn -gt (Get-Date).AddDays(-14) } |
  Sort-Object InstalledOn -Descending |
  Format-Table HotFixID, Description, InstalledOn -AutoSize

# Re-check the file version of the patched binary at the install path.
Get-Item "C:\Program Files\Vendor\Product\bin\service.exe" |
  Select-Object Name, @{Name='FileVersion';Expression={$_.VersionInfo.FileVersion}}, LastWriteTime

# Confirm the running process matches.
Get-Process service -ErrorAction SilentlyContinue |
  Select-Object Id, Path, @{Name='Version';Expression={(Get-Item $_.Path).VersionInfo.FileVersion}}

# RHEL / Rocky / AlmaLinux: confirm the errata applied and no rollback happened.
sudo dnf updateinfo list security all | grep -i cve-2026-33995
sudo rpm -qa --last | head -20
sudo rpm -q --changelog <package> | head -40 | grep -i cve-2026-33995

# Ubuntu / Debian: check apt history and changelog.
grep -i cve-2026-33995 /var/log/apt/history.log
apt changelog <package> 2>/dev/null | head -50

# Confirm the running binary matches what is on disk.
sudo readlink -f /proc/$(pidof <service>)/exe
sudo stat -c '%y %n' $(sudo readlink -f /proc/$(pidof <service>)/exe)

The verification step that catches the most surprises is the running-process check. I have walked into deployments where the patched RPM was installed three days earlier and nobody had restarted the daemon. The service was still answering on the vulnerable code path because the old image stayed mapped into memory. That is also the case where the vulnerability scanner reports green because the package version on disk matches the fixed version, and the attacker still owns you. Run the readlink check, run it again next sprint, and add it to your monitoring as a passive correlation rule.

India compliance notes

CERT-In's 6-hour reporting mandate under the April 2022 directions applies the moment you have a reasonable belief that an in-scope incident has occurred. For a CVE of this profile, the trigger is generally an indicator of compromise on a vulnerable host, not the disclosure of the CVE itself. I have seen counsel argue both ways. My working rule is: if you have outbound DNS to a recently registered domain from the vulnerable process and you cannot prove the patch landed before that connection, file. The penalty for over-filing is a follow-up email; the penalty for under-filing is regulatory exposure measured in lakhs and headlines.

RBI's Master Direction on Information Technology Governance, which took effect 1 April 2024, ties patching cadence directly to your information security framework. For BFSI customers I work with in Chennai, the auditor question is no longer "do you patch" but "what is your mean time to remediate for critical CVEs." Mine is 7 days for KEV-listed and 30 days for everything else, measured from disclosure to confirmed verification on the production fleet. If you cannot demonstrate that with telemetry, you are running on auditor goodwill.

SEBI's Cybersecurity and Cyber Resilience Framework for regulated entities likewise expects documented vulnerability management and a clear remediation timeline. MeitY's draft Digital Personal Data Protection rules continue to evolve, but the principle is consistent: if PII processing systems are exposed by the vulnerable component, the breach-notification clock starts the moment you know, not the moment your forensics report is finalized. Treat that as a hard internal SLA on root cause analysis.

Real-world incident I patched

The case I keep going back to was a retail bank's KYC microservice we onboarded as an IR retainer client in Chennai. They had CVE-2026-33995's family of bug on an internet-reachable management endpoint - not the exact CVE here, but the same category of network-reachable, low-precondition flaw. We saw in production an outbound connection to a domain registered 11 days earlier, originating from the vulnerable daemon. The SOC analyst on shift escalated within four minutes, which is the kind of response I write training docs about.

Containment took 22 minutes. We pulled the host from the load balancer, snapshotted memory, kept the disk online for forensics, and stood up a clean replacement from the golden image with the patched build already baked in. The patched build had been sitting in their internal artifact repo for nine days. Nine days. The reason it had not deployed was the change-advisory board meeting was scheduled for the following Tuesday. Saw in production, with my own eyes, a Rs 37 crore exposure that hung on a calendar invite.

The post-incident review surfaced three fixes we shipped that quarter. First, KEV-listed CVEs got a standing CAB exemption with rollback automation as the safety net. Second, the vulnerability scanner's findings flowed directly into a Jira queue with an SLA clock, so the patching team did not have to chase. Third, we hired a junior detection engineer at Rs 18 lakh per annum specifically to own Sigma rule coverage for the top 20 product families on the asset list. The ₹37 crore all-in incident cost would have covered that hire for the better part of a decade.

FAQs - extended

How does CVE-2026-33995 compare to recent KEV-listed bugs of the same class?

The precondition profile is similar to several CISA Known Exploited Vulnerabilities I have patched this year. Network reachability plus a small payload equals reliable exploitation. The CISA KEV catalog at cisa.gov/known-exploited-vulnerabilities-catalog is the page I refresh every Tuesday morning. If CVE-2026-33995 or its family appears there, your patch SLA collapses to the BOD 22-01 federal civilian deadline as a sanity benchmark, even if you are not a federal civilian agency.

What is the realistic blast radius if I cannot patch this week?

If the vulnerable surface is internet-reachable, the blast radius is everything that process can touch. Memory, configuration files, secrets in environment variables, kerberos tickets cached in /tmp, the cloud metadata endpoint at 169.254.169.254 if the host is in AWS or Azure or GCP. I treat any internet-reachable vulnerable host as already in the attacker's reachable graph. The question is whether they have noticed yet.

Does endpoint detection and response (EDR) software catch exploitation of CVE-2026-33995?

Sometimes. The honest answer is that EDR vendors ship behavior-based rules for the post-exploitation stage - the shell, the lateral movement, the credential dump - more reliably than for the initial exploit itself. If you have CrowdStrike, SentinelOne, Microsoft Defender for Endpoint, or an equivalent product, check the vendor's coverage notes. Do not assume coverage; ask for the rule ID.

What is the right communication to send to the business during the patch window?

Boring is good. "We are applying a vendor security patch to system X during a 30-minute maintenance window starting at 22:30 IST. No customer impact expected. Rollback plan is in place." Save the dramatic language for when there is an actual incident. The business has limited tolerance for the security team crying wolf, and CVE-2026-33995 is a routine patch in a long sequence of patches.

Should I pay for a third-party vulnerability assessment after patching?

For BFSI workloads in India, yes. The cost is Rs 3-12 lakh depending on scope, and the auditor's signed report is the artifact your CISO needs in the next regulatory cycle. For a small SaaS team a credentialed Nessus or OpenVAS scan with a clean output is enough. Match the spend to the regulator's expectations, not to the consultant's pitch deck.