CVE-2026-85089 in FreeRDP
Summary
by MITRE • 09/03/2026
FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Zero for reserved pad bytes (up to 576 bytes), leaving previously freed heap contents in the outgoing PDU. Because the send buffer is allocated with malloc (not zeroed), stale heap data — which may include cleartext credentials from prior sessions — can be sent to the receiving peer. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy (which forwards these PDUs) are affected, allowing disclosure of server/proxy process memory to a downstream client.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in FreeRDP versions 3.0.0 through 3.30.0 represents a critical information disclosure flaw rooted in improper memory management within the Remote Desktop Protocol implementation. Specifically, the defect resides in three distinct PDU writer functions located in the libfreerdp/core/info.c module: rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex. These functions are responsible for constructing Save Session Info PDUs, which are essential components of the RDP handshake and session establishment process. The core technical failure involves the handling of reserved padding fields within these protocol data units. Instead of explicitly zeroing out these bytes to ensure no residual data is transmitted, the code utilizes Stream_Seek to advance the stream pointer without writing any values. This approach assumes that the memory buffer being written to has been previously initialized or cleared, an assumption that proves false in this operational context.
The underlying cause of this vulnerability lies in how the send buffer for these PDUs is allocated and managed within the FreeRDP library. The buffers are typically allocated using standard malloc calls rather than calloc or explicit zeroing routines like Stream_Zero. Consequently, when a new PDU is constructed, it may reuse memory regions that were previously freed by other operations. Because this memory was not cleared before being repurposed for network transmission, any data previously stored in those heap locations remains intact until overwritten. In the specific case of the Save Session Info PDUs, the reserved padding fields are skipped over rather than initialized to zero, leaving them populated with whatever stale data happened to reside at that memory address prior to allocation reuse. This behavior creates a direct pathway for sensitive information from previous operations to leak into subsequent network packets sent to clients or proxy servers.
The operational impact of this vulnerability is severe due to the nature of the data potentially exposed through these uninitialized heap fields. Since FreeRDP handles authentication and session management, it frequently processes highly sensitive credentials such as usernames, passwords, NTLM hashes, and Kerberos tickets during the login process. If a previous connection involving credential transmission freed its associated memory buffers in close temporal proximity to the affected PDU generation, those cleartext credentials or cryptographic material may remain in the heap space that is subsequently reused for the Save Session Info padding. When this data is transmitted over the network, it can be captured by an attacker with access to the communication channel between the FreeRDP-based server and a downstream client or proxy. This constitutes a classic memory disclosure vulnerability where internal process state leaks outside of its intended boundary, potentially compromising user privacy and organizational security posture by exposing authentication secrets in transit.
From a classification perspective, this flaw aligns directly with CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, as it results in the unintended leakage of confidential data via network transmission. Furthermore, given that the vulnerability allows for remote information disclosure through crafted or simply observed protocol interactions during normal operation, it maps closely to ATT&CK technique T1539: Steal Web Session Cookie, although adapted here for RDP credentials rather than web cookies, and more broadly to T1005: Data from Local System. The attack vector is remote but requires the victim system to be a FreeRDP server or proxy actively handling connections, making it particularly dangerous in environments where such services are publicly accessible or exposed within internal networks without sufficient segmentation.
Mitigation strategies must focus on immediate patching and defensive coding practices. The primary remediation is to upgrade all affected systems to FreeRDP version 3.31.0 or later, where the developers have corrected the logic by replacing Stream_Seek with Stream_Zero for reserved padding fields, ensuring that memory is explicitly cleared before transmission. For organizations unable to patch immediately due to compatibility constraints, network-level controls such as TLS encryption should be enforced on all RDP connections to prevent eavesdropping of the transmitted PDUs. Additionally, implementing strict access control lists and firewall rules can limit exposure to only trusted clients. From a development standpoint, this incident highlights the critical importance of always initializing memory buffers before use in security-sensitive applications, particularly when dealing with network protocols where data integrity and confidentiality are paramount. Developers should adopt static analysis tools that detect uninitialized variable usage and enforce coding standards that mandate explicit zeroing of sensitive fields prior to serialization for transmission.