FreeRDP, an open-source Remote Desktop Protocol client, contains several security flaws including heap-based buffer overflow (CVE-2026-64620), double-free vulnerability via crafted .rdp files (CVE-2026-64621), arbitrary code execution through malicious RDP files (CVE-2026-64624), denial of service via crafted WindowIcon async messages (CVE-2026-67299), HTTP proxy request injection via redirection (CVE-2026-67289), and remote code execution or denial of service via audio input integer overflow (CVE-2026-68580). These vulnerabilities affect FreeRDP versions prior to 3.30.0+dfsg-0ubuntu0.24.04.1 and 3.30.0+dfsg-0ubuntu0.26.04.1 as packaged in Ubuntu and Red Hat Enterprise Linux 10 distributions. Red Hat and Ubuntu have released security advisories and patches to address these issues, with Red Hat providing updated packages for multiple architectures and Ubuntu providing fixes via standard system updates and Ubuntu Pro Extended Security Maintenance. No known exploits in the wild have been reported at this time.

The vulnerabilities allow an attacker to potentially execute arbitrary code remotely or cause denial of service conditions on systems running vulnerable versions of FreeRDP. Exploitation could be triggered by crafted RDP files or specially crafted network messages, impacting the confidentiality, integrity, and availability of affected systems. The issues include heap-based buffer overflow, double-free, integer overflow, and HTTP proxy request injection, which collectively represent significant security risks if unpatched.

Red Hat has released updated FreeRDP packages for Red Hat Enterprise Linux 10 and related variants that fix these vulnerabilities. Users should apply the security updates provided by Red Hat as detailed in the advisory RHSA-2026:54486. Ubuntu users should update their systems to the patched versions available through standard system updates or Ubuntu Pro Extended Security Maintenance. No additional mitigation steps are indicated beyond applying the official patches.