CVE-2026-85089

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.30.0

Description Uninitialized heap memory is transmitted in the reserved padding fields of the Save Session Info PDU. This occurs because three PDU writers in libfreerdp/core/info.c (rdp write logon info v2(), rdp write logon info plain(), and rdp write logon info ex()) utilize Stream Seek instead of Stream Zero for reserved pad bytes. Since the send buffer is allocated using malloc without being zeroed, stale heap data, potentially including cleartext credentials from previous sessions, can be disclosed to the receiving peer. This affects FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy.

Recommendations Update to version 3.31.0.