Vulnerabilities

FreeRDP 3.0.0 through 3.30.0 leak uninitialized heap memory to RDP peers because the Save Session Info PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) skip reserved padding bytes with Stream_Seek instead of zeroing them with Stream_Zero, leaving up to 576 bytes of stale heap content in each outgoing PDU (CWE-908, missing initialization). The flaw is triggered when a FreeRDP-based server that calls rdpUpdate::SaveSessionInfo - or freerdp-proxy, which forwards these PDUs - sends the logon-info message over a malloc-allocated (not zeroed) send buffer, so previously freed heap contents are transmitted to the receiving client. A connecting RDP client can therefore read residual server or proxy process memory, potentially including cleartext credentials from earlier sessions handled by the same process. Any FreeRDP 3.x-based RDP server or RDP proxy deployment is affected; the issue is fixed in FreeRDP 3.31.0. No exploitation in the wild is currently known (not in CISA KEV, EPSS about 0.4%), and one public advisory (GHSA-v649-94v2-p72q) is available.

Do: Upgrade FreeRDP to 3.31.0 or later on all server-side components (FreeRDP-based RDP servers and freerdp-proxy deployments), as versions 3.0.0 through 3.30.0 are affected. Because the leaked heap data may contain cleartext credentials from prior sessions, rotate credentials used through affected servers/proxies after patching and restrict which clients can connect to FreeRDP-based RDP endpoints. Audit installed FreeRDP 3.x versions in your estate and track the vendor advisory GHSA-v649-94v2-p72q for updates.

LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.

CVE-2026-13097 is a privilege escalation in FreeIPA caused by the uniqueness constraint on Kerberos principal name attributes in the 389-ds directory server failing to treat equivalent representations of the same principal name as duplicates (CWE-706, incorrectly-resolved name/reference). A user with sufficient LDAP write privileges can exploit this by creating a service principal whose name is an alternate but equivalent form of an existing privileged principal, bypassing the uniqueness check. The attacker can then acquire Kerberos service tickets for sensitive services as the impersonated principal, potentially achieving full domain compromise; the flaw scores 8.7 (high) on CVSS 3.1 with a scope change from the directory server to the Kerberos realm. Affected organizations are those running FreeIPA (Red Hat Enterprise Linux IdM) with 389-ds directory services. No exploitation is known at this time, no public proof-of-concept exists, and the flaw is not in CISA KEV; EPSS puts 30-day exploitation probability at 0.3% (19th percentile), though related FreeIPA flaw-chain research (anonymous clients creating reusable administrator credentials) has drawn attention to the product.

Do: Monitor Red Hat advisories and upgrade 389-ds-base and freeipa/IdM packages to the fixed releases for your RHEL version as soon as they are published, since no fixed version numbers are listed in the current data. Until patched, restrict LDAP write privileges on Kerberos principal name attributes to the minimum set of roles, and audit the directory for existing principals whose names are case- or format-equivalent variants of privileged principals (e.g., admin, kadmin, host and service principals). Given the related FreeIPA flaw-chain research on anonymous clients obtaining reusable administrator credentials, also review anonymous/simple-bind directory access and apply any companion FreeIPA fixes.

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. An application that uses iconv(3) to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer overflows if it uses one of the affected encoding modules.

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.

FreeRDP's Windows client before 3.29.0 contains a heap-based buffer overflow (CWE-122) in the clipboard virtual channel, where a CLIPRDR_FILE_CONTENTS_RESPONSE PDU is processed without validating the server-provided size against the destination buffer. The flaw is triggered when a user connects to a malicious or compromised RDP server and then performs a paste operation, at which point the server sends a data payload significantly larger than the client requested. The resulting heap memory corruption can allow the attacker to achieve remote code execution on the user's Windows workstation. Anyone running an affected FreeRDP Windows client version who connects to RDP servers they do not fully trust is exposed, since the CVSS 4.0 vector reflects network reachability with user interaction (the paste) but no privileges. Exploitation has not been reported in the wild; one public proof-of-concept advisory exists and EPSS currently assigns a low 0.5% probability of exploitation in the next 30 days.

Do: Upgrade the FreeRDP Windows client to version 3.29.0 or later, which fixes the missing size validation in the clipboard virtual channel. Until patched, instruct users to avoid paste operations when connected to untrusted or potentially compromised RDP servers, and inventory endpoints for FreeRDP client installations to confirm they are on a fixed version.

FreeRDP before 3.28.0 (affected out_length, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client random is decrypted into a fixed 32-byte buffer. Because the server publishes its RSA public key, an unauthenticated attacker can forge a ciphertext whose decrypted value is up to the full modulus length (e.g. 256 bytes for RSA-2048), overflowing the 32-byte heap buffer by up to ~224 attacker-controlled bytes pre-authentication, resulting in denial of service.