CVE-2026-85089
Received Received - Intake

Uninitialized Heap Memory Disclosure in FreeRDP

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Zero for reserved pad bytes (up to 576 bytes), leaving previously freed heap contents in the outgoing PDU. Because the send buffer is allocated with malloc (not zeroed), stale heap data — which may include cleartext credentials from prior sessions — can be sent to the receiving peer. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy (which forwards these PDUs) are affected, allowing disclosure of server/proxy process memory to a downstream client.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85089
EUVD
EUVD-2026-70299

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
freerdp freerdp From 3.0.0 (inc) to 3.31.0 (exc)
freerdp freerdp to 3.30.0 (inc)
freerdp freerdp 3.31.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-908 The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects FreeRDP versions 3.0.0 through 3.30.0. It involves the transmission of uninitialized heap memory in Save Session Info PDU reserved padding fields. Three functions in libfreerdp/core/info.c use Stream_Seek instead of Stream_Zero for padding, leaving stale heap data in outgoing PDUs. This data may include sensitive information like cleartext credentials from prior sessions.

Detection Guidance

To detect this vulnerability, monitor network traffic for FreeRDP sessions using tools like Wireshark or tcpdump. Look for Save Session Info PDUs with uninitialized padding fields. Check FreeRDP version with 'xfreerdp --version' or 'freerdp-proxy --version'. If using freerdp-proxy, inspect its logs for forwarded PDUs containing sensitive data.

Impact Analysis

The vulnerability allows disclosure of server or proxy process memory to a downstream client. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy are affected. Attackers could potentially recover sensitive data such as credentials or other heap contents sent over the network.

Mitigation Strategies

Immediately upgrade FreeRDP to version 3.31.0 or later. For freerdp-proxy, update to the patched version. Disable any FreeRDP-based servers using rdpUpdate::SaveSessionInfo until patched. Monitor network traffic for suspicious PDUs and credentials exposure. Apply network segmentation to limit RDP exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85089. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart