CVE-2026-85089 FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory
FreeRDP leaks uninitialized heap memory, potentially exposing cleartext credentials, to remote peers via Save Session Info PDUs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-85089?
CVE-2026-85089 is a high-severity vulnerability in Freerdp Freerdp, published on 3 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Zero for reserved pad bytes (up to 576 bytes), leaving previously freed heap contents in the outgoing PDU. Because the send buffer is allocated with malloc (not zeroed), stale heap data — which may include cleartext credentials from prior sessions — can be sent to the receiving peer. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy (which forwards these PDUs) are affected, allowing disclosure of server/proxy process memory to a downstream client.
Weakness: CWE-908
Which versions are affected by CVE-2026-85089?
It affects 1 product.
Products include Freerdp Freerdp.
How do I fix CVE-2026-85089?
Upgrade to a fixed version.
Is CVE-2026-85089 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-85089 exists.
Other vulnerabilities in Freerdp Freerdp
- CVE-2021-37594 Other in n/a
- CVE-2021-37595 Other in n/a
- CVE-2026-67305 FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr
- CVE-2026-66402 FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass
- CVE-2026-67289 FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
Sources
Also known as DEBIAN-CVE-2026-85089, GHSA-3525-288q-6qj4, GHSA-v649-94v2-p72q, UBUNTU-CVE-2026-85089.