CVE-2026-85089

FreeRDP 3.0.0 through 3.30.0 leak uninitialized heap memory to RDP peers because the Save Session Info PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) skip reserved padding bytes with Stream_Seek instead of zeroing them with Stream_Zero, leaving up to 576 bytes of stale heap content in each outgoing PDU (CWE-908, missing initialization). The flaw is triggered when a FreeRDP-based server that calls rdpUpdate::SaveSessionInfo - or freerdp-proxy, which forwards these PDUs - sends the logon-info message over a malloc-allocated (not zeroed) send buffer, so previously freed heap contents are transmitted to the receiving client. A connecting RDP client can therefore read residual server or proxy process memory, potentially including cleartext credentials from earlier sessions handled by the same process. Any FreeRDP 3.x-based RDP server or RDP proxy deployment is affected; the issue is fixed in FreeRDP 3.31.0. No exploitation in the wild is currently known (not in CISA KEV, EPSS about 0.4%), and one public advisory (GHSA-v649-94v2-p72q) is available.

What to do: Upgrade FreeRDP to 3.31.0 or later on all server-side components (FreeRDP-based RDP servers and freerdp-proxy deployments), as versions 3.0.0 through 3.30.0 are affected. Because the leaked heap data may contain cleartext credentials from prior sessions, rotate credentials used through affected servers/proxies after patching and restrict which clients can connect to FreeRDP-based RDP endpoints. Audit installed FreeRDP 3.x versions in your estate and track the vendor advisory GHSA-v649-94v2-p72q for updates.