FreeRDP versions 3.0.0 through 3.30.0 transmit uninitialized heap memory in the Save Session Info PDU reserved padding fields due to improper handling of reserved pad bytes in three PDU writers (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) within libfreerdp/core/info.c. These functions use Stream_Seek instead of Stream_Zero, leaving up to 576 bytes of previously freed heap data in the outgoing PDU. Since the send buffer is allocated with malloc and not zeroed, stale heap contents, which may include cleartext credentials from prior sessions, can be leaked to the receiving peer. This affects FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy forwarding these PDUs, allowing disclosure of server or proxy process memory to downstream clients. The vulnerability is tracked as CVE-2026-85089 and has a CVSS 3.1 base score of 6.5 (medium severity). A patch is available in FreeRDP version 3.31.0.

The vulnerability allows disclosure of uninitialized heap memory from the server or proxy process to downstream clients. This memory may contain sensitive information such as cleartext credentials from prior sessions, potentially compromising confidentiality. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

A patch is available in FreeRDP version 3.31.0 that corrects the handling of reserved padding bytes by zeroing them instead of leaving uninitialized memory. Users and administrators should upgrade affected FreeRDP versions to 3.31.0 or later to remediate this vulnerability.