CVE-2026-85089: FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory
FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex) use StreamSeek instead of StreamZero for reserved pad bytes (up to 576 bytes), leaving previously freed heap contents in the outgoing PDU. Because the send buffer is allocated with malloc (not zeroed), stale heap data — which may include cleartext credentials from prior sessions — can be sent to the receiving peer. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy (which forwards these PDUs) are affected, allowing disclosure of server/proxy process memory to a downstream client.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.31.0 - Compensating control
If using a FreeRDP-based server (rdpUpdate::SaveSessionInfo) or freerdp-proxy that forwards Save Session Info PDUs, restrict/limit which downstream clients can connect so disclosed server/proxy process memory is not exposed to untrusted parties.
Event History
Frequently Asked Questions
Which deployments are exposed to this disclosure?
FreeRDP-based servers that use rdpUpdate::SaveSessionInfo and freerdp-proxy instances that forward Save Session Info PDUs are affected. The disclosed data is sent to the downstream client receiving the PDU.
What does an attacker need to do to obtain leaked memory?
An attacker needs low-privileged access as a client or other downstream peer able to receive the affected Save Session Info PDUs. No user interaction is required.
Could the leaked data include credentials?
Yes. The uninitialized padding can contain stale heap contents from the server or proxy process, which may include cleartext credentials from prior sessions.
What versions should be treated as affected?
FreeRDP versions 3.0.0 through 3.30.0 are affected. Version 3.31.0 is identified as the first version not affected.