Description
FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Zero for reserved pad bytes (up to 576 bytes), leaving previously freed heap contents in the outgoing PDU. Because the send buffer is allocated with malloc (not zeroed), stale heap data — which may include cleartext credentials from prior sessions — can be sent to the receiving peer. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy (which forwards these PDUs) are affected, allowing disclosure of server/proxy process memory to a downstream client.
Published: 2026-09-03
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

FreeRDP implementations before version 3.31.0 transmit stale heap data during the Save Session Info procedure because reserved padding is sought rather than zeroed, leaving residual memory in outbound packets. This flaw can expose server or proxy memory contents, including cleartext credentials from previous sessions, to a remote RDP client, resulting in a confidentiality breach.

Affected Systems

Systems based on the FreeRDP library running versions 3.0.0 through 3.30.0 are affected. The vulnerability applies to both server-side components that use rdpUpdate::SaveSessionInfo and to the freerdp-proxy tool that forwards these PDUs between the server and a downstream client.

Risk and Exploitability

The CVSS score of 7.1 indicates a medium‑high severity risk of information disclosure. Because the EPSS score is not available, the likelihood of exploitation is uncertain, and the vulnerability is not listed in the CISA KEV catalog. Attackers who can establish a Remote Desktop session to a vulnerable FreeRDP server can capture the leaked heap payload in the outgoing Save Session Info PDUs, potentially retrieving prior session credentials.

Generated by OpenCVE AI on September 3, 2026 at 09:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the FreeRDP software stack to version 3.31.0 or newer, which removes the uninitialized heap usage in the Save Session Info code paths.
  • If an upgrade cannot be performed immediately, disable the Save Session Info functionality on the FreeRDP server or block the corresponding PDU traffic using firewall policies to prevent the transmission of uninitialized padding.
  • Review and monitor network traffic for anomalous Save Session Info PDUs and consider deploying intrusion detection rules that flag or drop packets containing uninitialized padding, especially when connecting to legacy FreeRDP installations.

Generated by OpenCVE AI on September 3, 2026 at 09:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 03 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 03 Sep 2026 01:15:00 +0000

Type Values Removed Values Added
Description FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Zero for reserved pad bytes (up to 576 bytes), leaving previously freed heap contents in the outgoing PDU. Because the send buffer is allocated with malloc (not zeroed), stale heap data — which may include cleartext credentials from prior sessions — can be sent to the receiving peer. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy (which forwards these PDUs) are affected, allowing disclosure of server/proxy process memory to a downstream client.
Title FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory
First Time appeared Freerdp
Freerdp freerdp
Weaknesses CWE-908
CPEs cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
Vendors & Products Freerdp
Freerdp freerdp
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Freerdp Freerdp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-03T13:58:37.769Z

Reserved: 2026-09-02T23:52:57.051Z

Link: CVE-2026-85089

cve-icon Vulnrichment

Updated: 2026-09-03T13:58:12.568Z

cve-icon NVD

Status : Received

Published: 2026-09-03T13:06:20.277

Modified: 2026-09-03T14:17:04.260

Link: CVE-2026-85089

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-03T01:04:43Z

Links: CVE-2026-85089 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T10:00:11Z

Weaknesses
  • CWE-908

    Use of Uninitialized Resource