CVE-2026-85089

FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Zero for reserved pad bytes (up to 576 bytes), leaving previously freed heap contents in the outgoing PDU. Because the send buffer is allocated with malloc (not zeroed), stale heap data — which may include cleartext credentials from prior sessions — can be sent to the receiving peer. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy (which forwards these PDUs) are affected, allowing disclosure of server/proxy process memory to a downstream client.

• CWE-908

• https://github.com/FreeRDP/FreeRDP
• https://github.com/FreeRDP/FreeRDP/blob/3.30.0/libfreerdp/core/info.c#L1541
• https://github.com/FreeRDP/FreeRDP/commit/056cede398d71c1f2540baebc26ec3327a249301
• https://github.com/FreeRDP/FreeRDP/commit/483c9388119f06bac420d92053cff9ef94e83bea
• https://github.com/FreeRDP/FreeRDP/releases/tag/3.31.0
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v649-94v2-p72q
• https://www.vulncheck.com/advisories/freerdp-before-3.31.0-information-disclosure-via-uninitialized-heap-memory
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v649-94v2-p72q

Published

Sep 3, 2026

Last Modified

Sep 3, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85062Colord is a tiny yet powerful tool for high-performance colo…6.9
• CVE-2026-85063node-csv is a full-featured CSV parser with a simple API tha…6.9
• CVE-2026-8507Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have o…9.8
• CVE-2026-8508An improper authentication vulnerability in the "social_logi…6.5
• CVE-2026-85084Out-of-bounds Write and Improper Validation of Array Index v…6.3
• CVE-2026-85085The Canva Android App before 2.376.0 allowed an external ori…9.6
• CVE-2026-8509Heap buffer overflow in WebML in Google Chrome prior to 148.…8.8
• CVE-2026-85090FreeRDP before 3.31.0 contains a heap out-of-bounds read vul…5.4
• CVE-2026-85091zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer ov…7.4
• CVE-2026-85092LiME through 1.12.0 fails to validate the disk acquisition o…6.6
• CVE-2026-85093Cheshire Cat AI's GET /memory/collections/{collection_id}/po…6.5
• CVE-2026-85094The Canva Android App before 2.376.0 did not restrict the h…8.8