CVE-2026-85089

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-85089

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85089.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-85089

Aliases

GHSA-v649-94v2-p72q

Downstream

DEBIAN-CVE-2026-85089

Published

2026-09-03T01:04:43.093Z

Modified

2026-09-04T03:30:39.706100534Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory

Details

FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex) use StreamSeek instead of StreamZero for reserved pad bytes (up to 576 bytes), leaving previously freed heap contents in the outgoing PDU. Because the send buffer is allocated with malloc (not zeroed), stale heap data — which may include cleartext credentials from prior sessions — can be sent to the receiving peer. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy (which forwards these PDUs) are affected, allowing disclosure of server/proxy process memory to a downstream client.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85089.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-908"
    ]
}

References

Affected packages

Git / github.com/freerdp/freerdp

Affected ranges

Type

GIT

Repo

https://github.com/freerdp/freerdp

Events

Introduced

a34fa7c49d2a39aa49ace1d7bea9656912d8c7cb

Fixed

aa8650b300aa4cabd85d9c72b431301509b9043f

Database specific

Show details

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.31.0"
        }
    ]
}

Affected versions

3.*

3.0.0

3.1.0

3.2.0

3.3.0

3.4.0

3.5.0

3.5.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85089.json"