CVE-2026-85089: 
NixOS vulnerability analysis and mitigation

CVE-2026-85089 is an information disclosure vulnerability in FreeRDP caused by the transmission of uninitialized heap memory in Save Session Info PDU reserved padding fields. It affects FreeRDP versions 3.0.0 through 3.30.0 (fixed in 3.31.0), impacting FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy. The vulnerability was published on September 3, 2026, with a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.1 (High) (Red Hat Advisory, GitHub Advisory).

The root cause is classified as CWE-908 (Use of Uninitialized Resource). Three PDU writer functions in libfreerdp/core/info.c — rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex — use Stream_Seek instead of Stream_Zero for reserved padding fields (up to 576 bytes), which advances the write cursor without zeroing the underlying bytes. Because the send buffer is allocated via malloc (not calloc) in Stream_New, the uninitialized heap region containing stale data from prior allocations is transmitted over the wire. The fix replaces Stream_Seek with Stream_Zero in the three pad writes and changes malloc to calloc in stream.c to zero-initialize new buffers (FreeRDP Advisory, Commit 056cede, Commit 483c938).

Any authenticated user connecting to an affected FreeRDP-based server or freerdp-proxy can receive up to 576 bytes of uninitialized heap memory per PDU, with no limit on the number of samples obtainable via reconnection. The leaked heap data may contain cleartext credentials from prior sessions — including NTLM usernames, domain names, and passwords recycled from NLA/RDSTLS handshake buffers. Under specific conditions (forced key adjacency, RSA-1024, TlsSecLevel ≤ 1), researchers demonstrated full RSA private key recovery from the leaked window, though this requires conditions not present in any shipped FreeRDP binary (FreeRDP Advisory).

A proof-of-concept exploit is publicly available in the FreeRDP security advisory, consisting of Python scripts (padlock_attack.py, certgrab.py, reconstruct.py) and a Dockerfile that demonstrate the heap disclosure by connecting as a normal RDP client and reading the leaked PDU data. Exploitation requires low privileges (authenticated RDP access) and no user interaction, with low attack complexity. The EPSS score is approximately 0.39% (32nd percentile), and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time (FreeRDP Advisory, GitHub Advisory).

1. Reconnaissance: Identify FreeRDP-based servers or freerdp-proxy instances running versions 3.0.0–3.30.0 exposed on TCP port 3389, using network scanning tools such as Shodan or Nmap.
2. Authenticate as a low-privileged user: Obtain valid RDP credentials (e.g., a standard domain or local account) to connect to the target server, as exploitation requires post-logon access.
3. Connect and capture the Save Session Info PDU: Use a standard FreeRDP client with the /dump:record feature to capture the raw PDU stream after logon. The server sends a PDUTYPE2_SAVE_SESSION_INFO (0x26) PDU containing the uninitialized padding bytes at wire offsets [37, 613).
4. Extract leaked heap data: Parse the captured dump using dumpparse.py to isolate the 576-byte uninitialized padding window from the PDU.
5. Resample for additional data: Reconnect repeatedly to obtain fresh heap samples, as each new connection may yield different stale heap contents (e.g., recycled NLA handshake buffers containing cleartext credentials).
6. Analyze leaked content: Inspect the extracted bytes for cleartext credentials (UTF-16 usernames, passwords) or, under the specific conditions described in the advisory, attempt RSA private key reconstruction using reconstruct.py by walking DER INTEGER fields and testing candidate factors against the server's public modulus (FreeRDP Advisory).

• Network: Repeated RDP connections (TCP/3389) from the same client IP with rapid reconnection patterns, potentially indicating heap resampling attempts; capture of PDUTYPE2_SAVE_SESSION_INFO (pduType2 = 0x26) PDUs with non-zero padding bytes in positions [37, 613).
• Logs: RDP session logs showing multiple short-lived authenticated sessions from the same source; authentication events followed immediately by disconnection without normal session activity.
• File System: Presence of FreeRDP dump files (from /dump:record) on client systems that may have been used to capture PDU streams; Python scripts named padlock_attack.py, certgrab.py, or reconstruct.py on attacker-controlled hosts.
• Process: Unusual xfreerdp or freerdp client processes launched with /dump:record flags on systems that are not expected to be RDP clients (FreeRDP Advisory).

Upgrade FreeRDP to version 3.31.0 or later, which replaces Stream_Seek with Stream_Zero in the three affected PDU writers and changes the stream buffer allocation from malloc to calloc (Commit 056cede, Commit 483c938). For systems unable to patch immediately, restrict network access to RDP services and limit connections to trusted, known-good clients only. Additionally, consider scrubbing the 4096-byte receive buffers (nla.c, rdstls.c) on release to reduce the sensitivity of any future similar mistakes (FreeRDP Advisory).

The vulnerability was reported by researcher VladimirEliTokarev and published by the FreeRDP maintainer (akallabeth) via GitHub Security Advisories. Red Hat tracked the issue via Bugzilla (Bug 2527811) and assigned it medium severity. The advisory includes a detailed technical write-up with a working PoC and a notable side-finding of an OOB write in NTLM MIC computation (not reachable in shipped binaries). Community discussion was observed on Bluesky and aggregated by vulnerability tracking services shortly after disclosure (FreeRDP Advisory, Red Hat Bugzilla).