Threat Intelligence Report: CVE-2026-85089

Executive Summary

CVE-2026-85089 is an information disclosure vulnerability in FreeRDP affecting versions 3.0.0 through 3.30.0. The flaw resides in three PDU writer functions within libfreerdp/core/info.c — rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex — where Stream_Seek is used instead of Stream_Zero for reserved padding fields in the Save Session Info PDU, causing up to 576 bytes of uninitialized heap memory to be transmitted over the network to a receiving peer. This disclosure can expose stale heap contents, potentially including cleartext credentials from prior sessions processed by the same process, placing FreeRDP-based servers and freerdp-proxy instances at risk of leaking sensitive process memory to a downstream client.

Technical Analysis

Vulnerability Mechanism

The vulnerability exists in how FreeRDP constructs the "Save Session Info" PDU, a protocol message used during Remote Desktop Protocol (RDP) session establishment to pass logon information between client and server. Specifically, three writer functions in libfreerdp/core/info.c:

1. rdp_write_logon_info_v2 — writes logon information using the version 2 structure format
2. rdp_write_logon_info_plain — writes logon information in plain/unencrypted format
3. rdp_write_logon_info_ex — writes logon information using the extended format

All three functions share a common defect: they use the Stream_Seek macro instead of Stream_Zero to advance the write pointer past reserved padding byte fields.

Technical Mechanism Detail

When constructing network packets, FreeRDP serializes data into a dynamically allocated send buffer. The buffer is allocated using malloc, which does not zero the allocated memory. Under normal operation, well-formed code would call Stream_Zero (or an equivalent) to explicitly write zero bytes into the reserved "padding" or "reserved" fields before advancing the buffer pointer. Instead, these functions use Stream_Seek, which merely advances the stream pointer without writing any data to the underlying memory region.

The consequence is that the bytes between the previous write position and the new position after the seek remain as whatever was previously stored in that portion of the heap allocation. Since the buffer was allocated with malloc, this memory can contain:

• Residual data from a prior network packet that used the same buffer
• Previously freed heap chunks that have been reallocated for this buffer
• Cleartext credentials from previous RDP logon sessions or authentication operations performed by the same server/proxy process

The NVD description notes that the padding footprint can be up to 576 bytes per PDU transmission.

Attack Surface

The disclosure occurs at the protocol level. The affected code paths are activated under the following conditions:

• FreeRDP-based servers that use the rdpUpdate::SaveSessionInfo callback mechanism to process logon/session information from connecting clients.
• freerdp-proxy instances that relay or forward session information PDUs between RDP endpoints. When the proxy reconstructs or regenerates Save Session Info PDUs destined for downstream connections, the uninitialized padding bytes are forwarded verbatim to the receiving endpoint.

The recipient of the PDU — the "downstream client" in the case of a proxy — receives the PDU including the uninitialized padding regions, allowing them to retrieve up to 576 bytes of heap content from the sending process's address space per vulnerable transmission. The CVSS score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects that this requires low-level privileges (a valid RDP session login attempt), has no user interaction, is exploitable over the network, and results in high confidentiality impact though no integrity or availability impact.

Underlying Class: CWE-908

The flaw falls under CWE-908: Use of Uninitialized Resource, a weakness class where an application uses a resource (memory, in this case) before it has been properly initialized. When such uninitialized memory is serialized into network protocol messages, it transitions into an information exposure vulnerability, allowing a remote party to recover fragments of process memory that were never intended for transmission.

Exploitation Scenarios

No public PoC or exploit code is currently available for CVE-2026-85089. The attack chain described below is inferred from the vulnerability class and the detailed NVD description.

Step 1 — Reconnaissance / Target Identification

The attacker must identify a reachable FreeRDP-based server or freerdp-proxy instance in the 3.0.0–3.30.0 version range. RDP services are commonly exposed on TCP port 3389 (default for RDP) or on alternative ports assigned to proxy deployments. Network mapping and banner grabbing can reveal the presence of FreeRDP implementations. Because the attacker needs valid credentials or at least the ability to initiate an RDP session negotiation, the target must accept unauthenticated session setup requests (RDP connection initiation occurs before credential validation).

Step 2 — Triggering the Vulnerability

The attacker establishes an RDP connection to the target and proceeds through the session establishment handshake. During this process, the attacker sends a Session Info PDU (or causes the server/proxy to generate one). On the server side, when the RDP stack constructs the response containing logon/session information via one of the three vulnerable writer functions, the padding regions in the outgoing PDU are lifted directly from uninitialized heap memory. Alternatively, when the attack targets a freerdp-proxy, the proxy's forwarding logic may regenerate the Save Session Info PDU, again leaving the padding bytes uninitialized.

The attacker need only:

1. Initiate a standard RDP connection to the target
2. Complete the session negotiation phase (which may include providing credentials — the PR:L privilege requirement in the CVSS vector suggests the attacker must have some level of access, though RDP pre-authentication negotiation partially precedes credential submission)
3. Receive the server/proxy response containing the Save Session Info PDU
4. Parse the padding offsets in the received PDU and extract the residual heap bytes

Because the padding is transmitted as part of a valid protocol message, standard firewalls and network security monitoring will typically allow the traffic — this is legitimate-looking RDP protocol conversation.

Step 3 — Payload / Execution Method

The "payload" is not arbitrary code, but rather the disclosure channel itself. The attacker submits a legitimate RDP session request. No malformed packets, no protocol violations, and no fuzzing payloads are required. The attack is purely passive from the attacker's perspective: they read data that the server should never have sent.

The attack can be repeated. Each new session establishment triggers another Save Session Info PDU transmission. If the server/proxy process reuses the same send buffer across connections (a common pattern for long-lived server processes), stale heap data from multiple prior sessions — potentially spanning different users and different authentication contexts — accumulates in the buffer. Repeated session initiations allow the attacker to collect multiple 576-byte samples of heap memory, increasing the probability of capturing sensitive artifacts such as:

• Cleartext passwords or password hashes from prior authentication operations
• Session tokens or ticket blobs
• Internal data structures, pointers, or stack fragments that aid further memory-corruption attacks
• Other secrets handled by the server process (e.g., service account credentials)

Step 4 — Post-Exploitation Impact

Once the attacker has harvested sufficient heap disclosure samples, the impact branches based on the content of the leaked data:

• If cleartext credentials for other users or service accounts are recovered, the attacker can laterally move within the network, impersonating legitimate users or service principals.
• If internal memory layout information is leaked, the attacker gains a significant advantage for a subsequent memory-corruption exploit (heap spraying, ROP chain construction, etc.) targeting the same server or other services in the network.
• If the proxy forwards sessions between different network segments (e.g., DMZ to internal), leaked data may expose credentials used to access internal RDP endpoints, effectively pivoting the attacker from the DMZ into trusted zones.

Impact Assessment

Severity Score

Business Impact

• Confidentiality breach: disclosure of process memory containing potential cleartext credentials, session data, and internal memory artifacts.
• Compliance violation: organizations processing regulated data (e.g., PCI DSS, HIPAA, GDPR) may face reportable data breaches if leaked data includes authentication credentials for protected systems.
• Corporate credential exposure: FreeRDP servers that handle multiple concurrent sessions or are long-running may accumulate sensitive material in reusable heap buffers, making this a persistent leak rather than a one-time event.
• Blast radius: any network-reachable FreeRDP-based server or freerdp-proxy in the 3.0.0–3.30.0 range is exposed. The RDP protocol's prevalence across enterprise remote-access infrastructures magnifies the potential impact.

Affected Components

Detection Guidance

Below are detection mechanisms for identifying devices running vulnerable FreeRDP versions and potentially observing exploitation attempts.

Sigma Rule

title: FreeRDP Save Session Info PDU Uninitialized Memory Disclosure
id: d9555a92-3c4a-4e9a-8b5a-7a7f2d52ce0a
status: experimental
description: >
  Detects non-zero padding bytes in RDP Save Session Info PDUs which may indicate
  uninitialized heap memory disclosure (CVE-2026-85089) from FreeRDP servers
  and proxies running versions 3.0.0 through 3.30.0.
references:
  - https://www.cve.org/CVERecord?id=CVE-2026-85089
author: valtersit.com Threat Intelligence
date: 2026/01/23
logsource:
  category: network-connection
  product: rdp
detection:
  selection_padding:
    # Trigger on RDP X.224 Data / MCS Data containing Save Session Info
    # Look for reserved/padding fields non-zero (protocol specs define these as 0)
    # Intrusion detection tools can flag where pad bytes != 0x00
    info_packet_type: "SaveSessionInfo"
    # captures check on bytes 32-40 offset within the logon_info fields
    padding_check:
      - non_zero_padding: true
        size_gte: 1
        size_lte: 576
  condition: selection_padding
falsepositives:
  - Non-conforming RDP clients/servers that use padding fields for extension data
level: high
tags:
  - attack.exfiltration
  - attack.t1005
  - cve.2026.85089

YARA Rule

/*
  YARA rule to identify network captures or binary samples containing
  Save Session Info PDUs with non-zero padding that might indicate
  CVE-2026-85089 exploitation / vulnerable FreeRDP versions.

  This YARA rule checks for the structural pattern of RDP PDU headers and
  non-zero reserved padding area at plausible offsets.
*/
rule CVE_2026_85089_rdp_session_key_pdu {
    meta:
        author = "valtersit.com Threat Intelligence"
        date = "2026-01-23"
        description = "Detects Save Session Info PDUs with non-zero padding bytes indicating uninitialized heap memory disclosure"
        reference = "https://www.cve.org/CVERecord?id=CVE-2026-85089"
        cve = "CVE-2026-85089"
        score = 65
    
    strings:
        // RDP: X.224 Connection Confirm / Data TPDU indicator (varies), but we focus on
        // Save Session Info PDU structure signature: typically bytes that include
        // the logon info type v2 (0x0002) with a reserved field (RDP_LOGON_INFO_V2)
        $logon_v2_hdr = { 02 00 ?? ?? 00 00 00 00 } // For fields before Crypto
        $logon_plain_hdr = { 00 00 ?? ?? }            // plain header
        $logon_ex_hdr = { 03 00 ?? ?? }               // extended
        
        // Look for key sequence common in the info PDU : after this, 576 bytes of padding
        // These sequences may need adjusting (they're not fixed - protocol context needed)
        $seek_pattern_1 = { 00 00 00 ?? [0-576] ?? ?? ?? ?? } // generic
    
    condition:
        uint16(0) == 0x03 // Typically TPKT header version
        and (
            $logon_v2_hdr 
            or $logon_plain_hdr
            or $logon_ex_hdr
        )
        and filesize > 1000        // realistic PDU size
        and #seek_pattern_1 >= 1   // found any reference to big uninitialized chunk
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"ET EXPLOIT FreeRDP Save Session Info PDU Uninitialized Heap Memory Disclosure Attempt (CVE-2026-85089)"; flow:established,to_client; dsize:>1000; content:"|00 00 00 00|"; content:"|00 03 00 00|"; distance:0; within:10; pcre:"/.\x00{4,8}(?=.{0,200}\x00[^\x00])/s"; reference:cve,2026-85089; classtype:attempted-info-leak; sid:2026085089; rev:1; metadata:affected_product FreeRDP_3.0-3.30.0, attack_target Client_Endpoint, deployment Perimeter, signature_severity Major, created_at 2026_01_23, updated_at 2026_01_23;)

Elastic Detection

// Elastic EQL query to detect FreeRDP agents/servers that may be vulnerable to CVE-2026-85089
// This detects known banner/version strings or the behavioral signature
any where process.name == "xfreerdp" or process.name == "wlfreerdp" or process.name == "freerdp-proxy"
  or (network.protocol == "rdp" and network.direction == "ingress")

Enhanced EQL — Version detection:

// detect FreeRDP installations with known vulnerable version strings in metadata or cmdl args
any where 
  (process.args : ("*3.0.*", "*3.1.*", "*3.2.*", "*3.3.*") and process.name : ("*freerdp*", "*xfreerdp*", "*wlfreerdp*"))
  or (process.pe.version_info.file_version : "*3.1*" and process.pe.original_file_name : "*freerdp*")
  or (process.pe.version_info.file_version : "*3.2*" and process.pe.original_file_name : "*freerdp*")
  or (process.pe.version_info.file_version : "*3.3*" and process.pe.original_file_name : "*freerdp*")
  or (process.pe.version_info.file_version : "*3.0*" and process.pe.original_file_name : "*freerdp*")

Splunk SPL Query

index=network sourcetype=rdp*
| where like(product_version, "3.0%") OR like(product_version, "3.1%") 
   OR like(product_version, "3.2%") OR like(product_version, "3.3%")
   AND (like(product_name, "%freerdp%") OR like(product_name, "%FreeRDP%"))

Alternative SPL — for packet captures:

index=* sourcetype="pcap" protocol=rdp 
| search InfoPacketType="SaveSessionInfo" NOT PaddingBytes=0000 
| table _time, src_ip, dest_ip, src_port, dest_port, PaddingBytes
| eval suspicion=if(match(PaddingBytes, "[^0]{1,576}"), "SUSPICIOUS - Non-zero padding in PDU (Candidate CVE-2026-85089)", "OK")

Wazuh OSSEC Rule

<group name="rdp,">
  <!-- Detect FreeRDP vulnerable version strings from Sysmon/process logs or version strings -->
  <rule id="100899" level="8">
    <if_sid>92050</if_sid>  <!-- Parent process spawned -->
    <field name="win.eventdata.commandLine">(?i).*(xfreerdp|wlfreerdp|freerdp-proxy).*</field>
    <field name="win.eventdata.commandLine">(?i).*3\.[0-3](\.[0-9]+)?.*</field>
    <description>FreeRDP process starting with potentially vulnerable version 3.0 - 3.0</description>
    <group>rdp,vulnerability,</group>
    <options>no_full_log</options>
  </rule>
  
  <!-- Detect if the RDP service running has the presence of the known handle/memory signatures  -->
  <rule id="100901" level="10">
    <if_sid>100899</if_sid>
    <field name="win.eventdata.commandLine">(?i).*--sec.*</field>
    <description>High risk FreeRDP command</description>
    <group>rdp,vulnerability,</group>
  </rule>

  <!-- Sysmon DNS / Netconn for attempts to unusual RDP ports on the network -->
  <rule id="100900" level="6">
    <if_sid>100899</if_sid>
    <field name="win.eventdata.destinationPort">3389</field>
    <description>Potential access to FreeRDP server</description>
    <group>rdp</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status

Patch Confidence: 0/4 — UNPATCHED. No patch evidence has been observed from any tracked source at the time of publication. Per the NVD description, the fix is slated to appear in FreeRDP version 3.31.0, and the issue is present only in versions 3.0.0 through 3.30.0.

1. Immediate Mitigations (No Patch Available Yet)

• Restrict network access: Limit network connectivity to RDP services (TCP 3389 default, or the configured port for freerdp-proxy) to trusted IP ranges only. Place these services behind VPN or jump-host gateways where feasible.
• Upgrade if feasible: If FreeRDP 3.31.0 (or later) has been released at the time you read this, upgrade immediately to that version. Check for vendor announcements.
• Limit proxy forwarding: Where freerdp-proxy is used, restrict the number of downstream RDP clients that can connect to each proxy instance to limit the exposure of process memory.
• Rotate credentials frequently: Because stale heap memory may contain cleartext credentials from prior sessions, rotate service account credentials and any credentials used to authenticate to FreeRDP servers frequently until patching is complete.
• Set a lower max memory reuse: For deployments using embedded FreeRDP, implement configuration to minimize heap reuse patterns across sessions (e.g., forcing memory scrubbing after each session).
• Monitor RDP connections: Increase security monitoring on RDP handshake traffic, especially repeated session-initiation attempts from the same source IP, which may indicate a memory-harvesting attack pattern.

2. Upgrade / Patch Steps

1. When FreeRDP 3.31.0 is released, upgrade all deployed FreeRDP libraries, servers, and proxy binaries to this version or later.
2. Review the FreeRDP project release notes for the official advisory associated with CVE-2026-85089.
3. After upgrading, validate the fix by running a connection test and verifying that all padding bytes in Save Session Info PDUs are correctly zeroed.
4. Recompile any third-party servers or proxies that link against FreeRDP against the patched library version, then redeploy across the environment.

3. Long-Term Hardening

• Enable full memory sanitization in server processes where feasible — the Stream_Zero call should be standard practice; however, until patched, heap allocations may still contain stale data from prior system operations.
• Run RDP services in isolated or dedicated containers/processes to limit the sensitivity of data held in the same process memory.
• Implement RDP session recording to audit connection attempts and session contents for suspicious patterns (e.g., repeated rapid connections with no actual user activity).
• Monitor for heap-spray / memory-corruption secondary attacks: once leaked memory data has mapped out the heap layout, attackers will likely attempt follow-up memory-corruption attempts. Ensure that all other software on the RDP gateway hosts is up-to-date and protected by ASLR/DEP.
• Regular penetration testing of RDP-facing services should include validation that padding fields in protocol messages are zeroed — confirming the fix after upgrading.

References

1. NVD Entry — https://www.cve.org/CVERecord?id=CVE-2026-85089 (official vulnerability record; additional references may be listed there)
2. FreeRDP Project — https://github.com/FreeRDP/FreeRDP (official source repository; version 3.31.0 will contain the fix)
3. MITRE ATT&CK Technique T1005 — Data from Local System (for information-disclosure based attacks following the leak)
4. CWE-908 — https://cwe.mitre.org/data/definitions/908.html (weakness class for uninitialized resource use)

Known Threat Actor Activity

No threat-actor campaigns have been publicly attributed to this CVE as of the date of this report. No exploit-in-the-wild evidence has been observed. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public proof-of-concept or exploit code has been released as of writing. Monitoring of the FreeRDP security mailing list and RDP-focused security research communities is recommended for emerging evidence of active exploitation after public disclosure.

Report generated by valtersit.com Threat Intelligence — 2026-01-23. Persistent monitoring of CVE-2026-85089 was ongoing at the time of writing; an update will be published when FreeRDP 3.31.0 is released or when additional exploitation evidence surfaces.