CVE-2026-85089

FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Zero for reserved pad bytes (up to 576 bytes), leaving previously freed heap contents in the outgoing PDU. Because the send buffer is allocated with malloc (not zeroed), stale heap data — which may include cleartext credentials from prior sessions — can be sent to the receiving peer. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy (which forwards these PDUs) are affected, allowing disclosure of server/proxy process memory to a downstream client.

• CWE-908

• https://github.com/FreeRDP/FreeRDPProduct
• https://github.com/FreeRDP/FreeRDP/blob/3.30.0/libfreerdp/core/info.c#L1541Product
• https://github.com/FreeRDP/FreeRDP/commit/056cede398d71c1f2540baebc26ec3327a249301Patch
• https://github.com/FreeRDP/FreeRDP/commit/483c9388119f06bac420d92053cff9ef94e83beaPatch
• https://github.com/FreeRDP/FreeRDP/releases/tag/3.31.0Product, Release Notes
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v649-94v2-p72qExploit, Mitigation, Vendor Advisory
• https://www.vulncheck.com/advisories/freerdp-before-3.31.0-information-disclosure-via-uninitialized-heap-memoryPatch, Release Notes, Third Party Advisory
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v649-94v2-p72qExploit, Mitigation, Vendor Advisory

Published

Sep 3, 2026

Last Modified

Sep 9, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85083The ANJIA AJL33PC0801 IP camera uses a hard-coded credential…6.8
• CVE-2026-85084Out-of-bounds Write and Improper Validation of Array Index v…6.3
• CVE-2026-85085The Canva Android App before 2.376.0 allowed an external ori…9.6
• CVE-2026-85086Improper certificate validation, Initialization of a resourc…6.9
• CVE-2026-85087Improper certificate validation, Return of wrong status code…6.9
• CVE-2026-85088Improper Validation of Certificate with Host Mismatch in the…6.9
• CVE-2026-8509Heap buffer overflow in WebML in Google Chrome prior to 148.…8.8
• CVE-2026-85090FreeRDP before 3.31.0 contains a heap out-of-bounds read vul…5.4
• CVE-2026-85091zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer ov…7.4
• CVE-2026-85092LiME through 1.12.0 fails to validate the disk acquisition o…6.6
• CVE-2026-85093Cheshire Cat AI's GET /memory/collections/{collection_id}/po…6.5
• CVE-2026-85094The Canva Android App before 2.376.0 did not restrict the h…8.8