CVE-2026-85089

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-85089", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-09-02T23:52:57.051Z", "datePublished": "2026-09-03T01:04:43.093Z", "dateUpdated": "2026-09-03T13:58:37.769Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-03T01:04:43.093Z"}, "datePublic": "2026-08-13T00:00:00.000Z", "title": "FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory", "descriptions": [{"lang": "en", "value": "FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Zero for reserved pad bytes (up to 576 bytes), leaving previously freed heap contents in the outgoing PDU. Because the send buffer is allocated with malloc (not zeroed), stale heap data \u2014 which may include cleartext credentials from prior sessions \u2014 can be sent to the receiving peer. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy (which forwards these PDUs) are affected, allowing disclosure of server/proxy process memory to a downstream client."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Use of Uninitialized Resource", "cweId": "CWE-908", "type": "CWE"}]}], "affected": [{"vendor": "FreeRDP", "product": "FreeRDP", "defaultStatus": "unaffected", "versions": [{"version": "3.0.0", "lessThan": "3.31.0", "status": "affected", "versionType": "semver"}, {"version": "3.31.0", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.31.0", "versionStartIncluding": "3.0.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v649-94v2-p72q", "name": "GitHub Security Advisory (GHSA-v649-94v2-p72q)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/FreeRDP/FreeRDP/commit/056cede398d71c1f2540baebc26ec3327a249301", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/FreeRDP/FreeRDP/commit/483c9388119f06bac420d92053cff9ef94e83bea", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.31.0", "name": "FreeRDP 3.31.0 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/FreeRDP/FreeRDP/blob/3.30.0/libfreerdp/core/info.c#L1541", "tags": ["technical-description"]}, {"url": "https://github.com/FreeRDP/FreeRDP", "tags": ["product"]}, {"name": "VulnCheck Advisory: FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-information-disclosure-via-uninitialized-heap-memory"}], "credits": [{"lang": "en", "value": "VladimirEliTokarev", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v649-94v2-p72q", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-03T13:58:31.244942Z", "id": "CVE-2026-85089", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-03T13:58:37.769Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-85089", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-03T13:58:31.244942Z"}}}], "references": [{"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v649-94v2-p72q", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-03T13:58:12.568Z"}}], "cna": {"title": "FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory", "credits": [{"lang": "en", "type": "finder", "value": "VladimirEliTokarev"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "FreeRDP", "product": "FreeRDP", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.31.0", "versionType": "semver"}, {"status": "unaffected", "version": "3.31.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-08-13T00:00:00.000Z", "references": [{"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v649-94v2-p72q", "name": "GitHub Security Advisory (GHSA-v649-94v2-p72q)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/FreeRDP/FreeRDP/commit/056cede398d71c1f2540baebc26ec3327a249301", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/FreeRDP/FreeRDP/commit/483c9388119f06bac420d92053cff9ef94e83bea", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.31.0", "name": "FreeRDP 3.31.0 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/FreeRDP/FreeRDP/blob/3.30.0/libfreerdp/core/info.c#L1541", "tags": ["technical-description"]}, {"url": "https://github.com/FreeRDP/FreeRDP", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-information-disclosure-via-uninitialized-heap-memory", "name": "VulnCheck Advisory: FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Zero for reserved pad bytes (up to 576 bytes), leaving previously freed heap contents in the outgoing PDU. Because the send buffer is allocated with malloc (not zeroed), stale heap data \u2014 which may include cleartext credentials from prior sessions \u2014 can be sent to the receiving peer. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy (which forwards these PDUs) are affected, allowing disclosure of server/proxy process memory to a downstream client."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-908", "description": "Use of Uninitialized Resource"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.31.0", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-03T01:04:43.093Z"}}}, "cveMetadata": {"cveId": "CVE-2026-85089", "state": "PUBLISHED", "dateUpdated": "2026-09-03T13:58:37.769Z", "dateReserved": "2026-09-02T23:52:57.051Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-09-03T01:04:43.093Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "FreeRDP", "vendor": "FreeRDP", "versions": [{"lessThan": "3.31.0", "status": "affected", "version": "3.0.0", "versionType": "semver"}, {"status": "unaffected", "version": "3.31.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*", "matchCriteriaId": "67A96370-FC2E-4704-9948-3EBB74AA81E2", "versionEndExcluding": "3.31.0", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Zero for reserved pad bytes (up to 576 bytes), leaving previously freed heap contents in the outgoing PDU. Because the send buffer is allocated with malloc (not zeroed), stale heap data \u2014 which may include cleartext credentials from prior sessions \u2014 can be sent to the receiving peer. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy (which forwards these PDUs) are affected, allowing disclosure of server/proxy process memory to a downstream client."}], "id": "CVE-2026-85089", "lastModified": "2026-09-09T19:12:57.990", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-85089", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-03T13:58:31.244942Z", "version": "2.0.3"}}]}, "published": "2026-09-03T13:06:20.277", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://github.com/FreeRDP/FreeRDP"}, {"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://github.com/FreeRDP/FreeRDP/blob/3.30.0/libfreerdp/core/info.c#L1541"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://github.com/FreeRDP/FreeRDP/commit/056cede398d71c1f2540baebc26ec3327a249301"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://github.com/FreeRDP/FreeRDP/commit/483c9388119f06bac420d92053cff9ef94e83bea"}, {"source": "disclosure@vulncheck.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/FreeRDP/FreeRDP/releases/tag/3.31.0"}, {"source": "disclosure@vulncheck.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v649-94v2-p72q"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch", "Release Notes", "Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/freerdp-before-3.31.0-information-disclosure-via-uninitialized-heap-memory"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v649-94v2-p72q"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-908"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "FreeRDP: freerdp-proxy: FreeRDP: Information disclosure via uninitialized heap memory in Save Session Info PDU", "id": "2527811", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527811"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-908", "details": ["A flaw was found in FreeRDP. This vulnerability allows a remote attacker with low privileges to disclose sensitive information from the server or proxy process memory to a downstream client. This occurs because certain functions responsible for writing Save Session Info Protocol Data Units (PDUs) use Stream_Seek instead of Stream_Zero for reserved padding fields, leading to the transmission of uninitialized heap memory that may contain cleartext credentials from previous sessions."], "name": "CVE-2026-85089", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "freerdp", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "freerdp", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "freerdp", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "freerdp", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "freerdp", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-09-03T01:04:43Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-85089\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-85089\nhttps://github.com/FreeRDP/FreeRDP\nhttps://github.com/FreeRDP/FreeRDP/blob/3.30.0/libfreerdp/core/info.c#L1541\nhttps://github.com/FreeRDP/FreeRDP/commit/056cede398d71c1f2540baebc26ec3327a249301\nhttps://github.com/FreeRDP/FreeRDP/commit/483c9388119f06bac420d92053cff9ef94e83bea\nhttps://github.com/FreeRDP/FreeRDP/releases/tag/3.31.0\nhttps://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v649-94v2-p72q\nhttps://www.vulncheck.com/advisories/freerdp-before-3.31.0-information-disclosure-via-uninitialized-heap-memory"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.31.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.31.0"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "FreeRDP", "source": "cna", "vendor": "FreeRDP"}, "product": "freerdp", "vendor": "freerdp"}], "created": "2026-09-03T09:30:08.123051+00:00", "updated": "2026-09-03T10:00:11.116811+00:00", "vendors": ["freerdp", "freerdp$PRODUCT$freerdp"]}