Description

FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Zero for reserved pad bytes (up to 576 bytes), leaving previously freed heap contents in the outgoing PDU. Because the send buffer is allocated with malloc (not zeroed), stale heap data — which may include cleartext credentials from prior sessions — can be sent to the receiving peer. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy (which forwards these PDUs) are affected, allowing disclosure of server/proxy process memory to a downstream client.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-03T13:06:20.277Z",
  "pubdate": "2026-09-03T13:06:20.277Z",
  "executiveSummary": "A memory disclosure vulnerability exists in FreeRDP versions 3.0.0 through 3.30.0, characterized by the transmission of uninitialized heap memory within Save Session Info PDU reserved padding fields.\nThe vulnerability arises because specific PDU writing functions utilize Stream_Seek to bypass reserved pad bytes instead of explicitly zeroing them with Stream_Zero. Consequently, the outgoing PDU buffer—allocated via malloc without subsequent zeroing—may contain stale heap data from previous memory allocations.\nThis flaw impacts FreeRDP-based servers leveraging rdpUpdate::SaveSessionInfo and the freerdp-proxy component, which forwards these PDUs to downstream clients.\nThe primary risk involves the unauthorized exposure of sensitive server or proxy process memory to a connected client. Such leaked memory contents may include cleartext credentials or other confidential data residues from prior sessions.\nAn attacker acts as a client connected to an affected server or proxy, triggering the vulnerable code path to receive a PDU containing sensitive, stale heap data. Exploitation requires the attacker to successfully connect to a vulnerable endpoint, but no additional privileges are necessary beyond the ability to initiate an RDP session.",
  "technicalDetails": "The vulnerability resides in the core/info.c file of the libfreerdp library. Specifically, three functions—rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex—are responsible for constructing Save Session Info PDUs. During the PDU serialization process, these functions are required to handle reserved padding fields, which can span up to 576 bytes.\nThe root cause of the vulnerability is the improper handling of these reserved padding bytes. Instead of ensuring these bytes are cleared, the implementation utilizes Stream_Seek to advance the buffer pointer, effectively skipping the bytes without initializing them. Because the underlying memory for the send buffer is allocated using malloc, which does not guarantee that the allocated memory is zeroed, the bytes remain populated with whatever data resided in that memory segment during its previous allocation lifecycle.\nThe attack flow proceeds as follows: 1. A previously active process, potentially one handling sensitive credentials or keys, frees a memory block on the heap. 2. A FreeRDP process subsequently allocates a buffer for a Save Session Info PDU, and the heap allocator assigns the recently freed memory segment to this new buffer. 3. The PDU construction functions (rdp_write_logon_info_v2, rdp_write_logon_info_plain, or rdp_write_logon_info_ex) are invoked to build the session information. 4. Due to the reliance on Stream_Seek, the reserved padding fields are not cleared, causing the stale memory contents (leftover from the previous process) to be written into the PDU buffer. 5. The server or proxy transmits this PDU to the client. 6. The client receives the PDU and inspects the padding fields, effectively accessing the sensitive cleartext data that was leaked from the server or proxy heap memory.\nThis vulnerability effectively turns the RDP protocol into a side-channel for memory leakage. Since the leaked contents are dependent on the state of the heap at the time of allocation, the attacker may need to perform multiple requests to increase the probability of capturing interesting data. The impact is significant, as it enables the potential exfiltration of authentication material or sensitive configuration data stored in the process heap, leading to a compromise of confidentiality."
}