Executive brief
FreeRDP is a popular open-source RDP server implementation used to provide remote desktop access. A flaw in its RDPGFX graphics serializer sends up to 300 bytes of uninitialized heap memory—including live pointers and function addresses—to RDP clients, allowing attackers to break address space layout randomization (ASLR) and leak critical memory offsets needed for further exploitation.
Technical details
FreeRDP versions 2.0.0 through 3.30.0 fail to initialize padding bytes in the ResetGraphics PDU serializer. The 340-byte fixed wire format is allocated via malloc() without clearing, and the serializer advances over unused padding without writing zeros, leaving stale heap content in place. An attacker with access to an active RDPGFX virtual channel (typically after RDP authentication) can trigger a ResetGraphics operation and observe leaked heap memory including live pointers and GLib function addresses, defeating ASLR. The vulnerability is classified as CWE-908 (Use of Uninitialized Resource) and CWE-200 (Exposure of Sensitive Information). The fix involves changing malloc() to calloc() in stream allocation (commit 483c938) and explicitly writing zeros to the padding region; FreeRDP 3.31.0 includes these mitigations.
Affected products
- FreeRDP FreeRDP 2.0.0 through 3.30.0
Timeline
- 2026-08-31: disclosed: GHSA-r7jx-j9h7-j4xj advisory published
- 2026-09-15: patched: FreeRDP 3.31.0 released with fix