Vulnerabilities

FreeRDP 3.0.0 through 3.30.0 leak uninitialized heap memory to RDP peers because the Save Session Info PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) skip reserved padding bytes with Stream_Seek instead of zeroing them with Stream_Zero, leaving up to 576 bytes of stale heap content in each outgoing PDU (CWE-908, missing initialization). The flaw is triggered when a FreeRDP-based server that calls rdpUpdate::SaveSessionInfo - or freerdp-proxy, which forwards these PDUs - sends the logon-info message over a malloc-allocated (not zeroed) send buffer, so previously freed heap contents are transmitted to the receiving client. A connecting RDP client can therefore read residual server or proxy process memory, potentially including cleartext credentials from earlier sessions handled by the same process. Any FreeRDP 3.x-based RDP server or RDP proxy deployment is affected; the issue is fixed in FreeRDP 3.31.0. No exploitation in the wild is currently known (not in CISA KEV, EPSS about 0.4%), and one public advisory (GHSA-v649-94v2-p72q) is available.

Do: Upgrade FreeRDP to 3.31.0 or later on all server-side components (FreeRDP-based RDP servers and freerdp-proxy deployments), as versions 3.0.0 through 3.30.0 are affected. Because the leaked heap data may contain cleartext credentials from prior sessions, rotate credentials used through affected servers/proxies after patching and restrict which clients can connect to FreeRDP-based RDP endpoints. Audit installed FreeRDP 3.x versions in your estate and track the vendor advisory GHSA-v649-94v2-p72q for updates.

LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.

CVE-2026-13097 is a privilege escalation in FreeIPA caused by the uniqueness constraint on Kerberos principal name attributes in the 389-ds directory server failing to treat equivalent representations of the same principal name as duplicates (CWE-706, incorrectly-resolved name/reference). A user with sufficient LDAP write privileges can exploit this by creating a service principal whose name is an alternate but equivalent form of an existing privileged principal, bypassing the uniqueness check. The attacker can then acquire Kerberos service tickets for sensitive services as the impersonated principal, potentially achieving full domain compromise; the flaw scores 8.7 (high) on CVSS 3.1 with a scope change from the directory server to the Kerberos realm. Affected organizations are those running FreeIPA (Red Hat Enterprise Linux IdM) with 389-ds directory services. No exploitation is known at this time, no public proof-of-concept exists, and the flaw is not in CISA KEV; EPSS puts 30-day exploitation probability at 0.3% (19th percentile), though related FreeIPA flaw-chain research (anonymous clients creating reusable administrator credentials) has drawn attention to the product.

Do: Monitor Red Hat advisories and upgrade 389-ds-base and freeipa/IdM packages to the fixed releases for your RHEL version as soon as they are published, since no fixed version numbers are listed in the current data. Until patched, restrict LDAP write privileges on Kerberos principal name attributes to the minimum set of roles, and audit the directory for existing principals whose names are case- or format-equivalent variants of privileged principals (e.g., admin, kadmin, host and service principals). Given the related FreeIPA flaw-chain research on anonymous clients obtaining reusable administrator credentials, also review anonymous/simple-bind directory access and apply any companion FreeIPA fixes.

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. An application that uses iconv(3) to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer overflows if it uses one of the affected encoding modules.