Executive brief
FreeRDP is a widely-used remote desktop protocol library that enables secure connections to Windows systems. Versions 3.0.0 through 3.30.0 contain a memory leak vulnerability where uninitialized heap data—potentially including cleartext credentials from previous sessions—is transmitted in network protocol messages. An attacker on the receiving end of an RDP connection could capture this stale memory to steal sensitive information like usernames and passwords.
Technical details
The vulnerability exists in three PDU writer functions in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) that incorrectly use Stream_Seek instead of Stream_Zero when handling reserved padding fields in Save Session Info PDUs. This leaves uninitialized heap memory (up to 576 bytes) in the outgoing packets. Because the send buffer is allocated with malloc without zeroing, stale heap data from freed memory—which may contain cleartext credentials, session tokens, or other sensitive information—can be sent to the remote peer. The vulnerability affects FreeRDP-based servers and proxies that forward these PDUs. No user interaction is required; exploitation occurs automatically during normal RDP session handling. The fix is available in version 3.31.0 and later.
Affected products
- FreeRDP FreeRDP 3.0.0 through 3.30.0
Timeline
- 2026-09-03: disclosed: CVE-2026-85089 published