FreeRDP, an open-source RDP client, contains multiple security flaws: CVE-2026-64624 allows arbitrary code execution via maliciously crafted RDP files; CVE-2026-67299 enables denial of service through a crafted WindowIcon asynchronous message; CVE-2026-67289 permits HTTP proxy request injection via redirection; and CVE-2026-68580 causes remote code execution or denial of service via an audio input integer overflow. These vulnerabilities affect FreeRDP versions before 3.30.0+dfsg-0ubuntu0.24.04.1 and 3.30.0+dfsg-0ubuntu0.26.04.1, including packages distributed with Red Hat Enterprise Linux 8 and Ubuntu LTS releases. Red Hat has released updated packages (freerdp-2.11.7-11.el8_10) that address these issues. The vulnerabilities have been rated with high severity but no active exploitation has been reported.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code remotely, cause denial of service conditions, or inject malicious HTTP proxy requests. This could compromise the confidentiality, integrity, and availability of affected systems running vulnerable FreeRDP versions. The impact is significant given the ability to execute code remotely and disrupt service.

Red Hat has released security updates for FreeRDP in Red Hat Enterprise Linux 8 and related distributions. Users should apply the updated packages (e.g., freerdp-2.11.7-11.el8_10) as provided by Red Hat via official channels. Ubuntu users should update to the fixed versions available in their respective LTS releases. Standard system updates will include these fixes. There are no indications that additional mitigations beyond applying these official patches are necessary.