CyberRota Analysis
AI-GeneratedFreeRDP versions 3.0.0 through 3.30.0 are vulnerable due to the transmission of uninitialized heap memory in the Save Session Info PDU, potentially exposing up to 576 bytes of stale data, including cleartext credentials from previous sessions. This vulnerability primarily affects FreeRDP-based servers and proxies that utilize the rdpUpdate::SaveSessionInfo function, posing a risk of sensitive information disclosure to downstream clients. Organizations using these versions should prioritize patching to mitigate potential credential leaks and enhance their security posture.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Zero for reserved pad bytes (up to 576 bytes), leaving previously freed heap contents in the outgoing PDU. Because the send buffer is allocated with malloc (not zeroed), stale heap data — which may include cleartext credentials from prior sessions — can be sent to the receiving peer. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy (which forwards these PDUs) are affected, allowing disclosure of server/proxy process memory to a downstream client.
Related CVEs
Other vulnerabilities affecting the same vendor(s)