CVE-2026-85089
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c use Stream_Seek instead of Stream_Zero for reserved pad bytes (up to 576 bytes), leaving previously freed heap contents in the outgoing PDU. Because the send buffer is allocated with malloc (not zeroed), stale heap data — which may include cleartext credentials from prior sessions — can be sent to the receiving peer. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy (which forwards these PDUs) are affected, allowing disclosure of server/proxy process memory to a downstream client.
Risk Assessment
Disclosure of heap memory can lead to leakage of sensitive data such as credentials, potentially enabling session hijacking or privilege escalation.
Recommendation
Update FreeRDP to version 3.31.0 or later. If unable to update, restrict trust to clients and monitor traffic for suspicious PDUs.
Other vulnerabilities in FreeRDP
See all- CVE-2026-23732High
FreeRDP before version 3.21.0 has a vulnerability in FastGlyph parsing where data length is not validated against the minimum size implied by cx/cy. A malicious server can trigger a client-side global buffer overflow, causing a crash (DoS).
- CVE-2026-22856High
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race in the serial channel IRP thread tracking allows a heap use‑after‑free when one thread removes an entry from serial->IrpThreads while another reads it. This vulnerability is fixed in 3.20.1.
- CVE-2013-4119High
FreeRDP before 1.1.0-beta+2013071101 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by disconnecting before authentication has finished.
- CVE-2013-4118High
FreeRDP before 1.1.0-beta1 allows remote attackers to cause a denial of service via NULL pointer dereference, leading to application crash.
- CVE-2014-0250High
Multiple integer overflows in client/X11/xf_graphics.c in FreeRDP allow remote attackers to have an unspecified impact via the width and height to the xf_Pointer_New or xf_Bitmap_Decompress function, which causes an incorrect amount of memory to be allocated.
- CVE-2026-91949Critical
FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.
- CVE-2026-63633Critical
In FreeRDP before 3.28.0, freerdp_dsp_decode_opus calls Stream_EnsureRemainingCapacity on the context buffer even though opus_decode writes to the caller-supplied stream. A malicious RDP server negotiating WAVE_FORMAT_OPUS can cause large decoded frames to be written beyond the allocated buffer, leading to client heap corruption, crash, and potential code execution.
- CVE-2026-55194Critical
In FreeRDP before 3.27.0, rpc_client_recv_fragment ensures response reassembly stream capacity using only the server-declared alloc_hint rather than the actual StubLength. A malicious TS Gateway can send a response with a small alloc_hint and a much larger frag_length, causing a buffer overflow in the pdu->s buffer. This can crash the client and may permit code execution.
- CVE-2026-55191Critical
In FreeRDP before 3.27.0, clients negotiating RDPGFX AVC444 calculate the intermediate YUV444 allocation size using 32-bit multiplication in avc444_ensure_buffer. A malicious RDP server can supply surface dimensions causing integer wrap, leading to an undersized buffer allocation. This can cause a client crash and may permit code execution.
- CVE-2026-73242Critical
FreeRDP, a free implementation of the Remote Desktop Protocol, prior to version 3.30.0 has a vulnerability in the kerberos_DecryptMessage function that fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets. A malicious RDP peer can trigger out-of-bounds reads and in-place writes during CredSSP/NLA Kerberos decryption.
Original NVD description (English source)
FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Zero for reserved pad bytes (up to 576 bytes), leaving previously freed heap contents in the outgoing PDU. Because the send buffer is allocated with malloc (not zeroed), stale heap data — which may include cleartext credentials from prior sessions — can be sent to the receiving peer. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy (which forwards these PDUs) are affected, allowing disclosure of server/proxy process memory to a downstream client.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS