Red Hat Product Security issued an advisory (RHSA-2026:6384) for FreeRDP addressing two vulnerabilities: CVE-2026-26965, an arbitrary code execution vulnerability via a heap out-of-bounds write in the RLE planar decode path, and CVE-2026-26955, an arbitrary code execution vulnerability via a heap buffer overflow in the GDI surface pipeline. These vulnerabilities affect FreeRDP versions included in Red Hat Enterprise Linux 9.4 Extended Update Support and related CodeReady Linux Builder and SAP Solutions variants. The advisory provides updated packages (freerdp-2.11.2-1.el9_4.3) to remediate these issues. The vulnerabilities are rated with high severity by Red Hat, though no CVSS score is published. No known exploits in the wild have been reported at the time of the advisory.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code on systems running vulnerable versions of FreeRDP. This could lead to full compromise of the affected system. The vulnerabilities stem from memory corruption issues (heap out-of-bounds write and heap buffer overflow) in FreeRDP's decoding and rendering components.

Red Hat has released updated FreeRDP packages that fix these vulnerabilities. Users of Red Hat Enterprise Linux 9.4 Extended Update Support and related variants should apply the provided security update (freerdp-2.11.2-1.el9_4.3) as detailed in Red Hat advisory RHSA-2026:6384 and the referenced article https://access.redhat.com/articles/11258. Applying this update mitigates the vulnerabilities. No additional mitigation steps are indicated by the vendor advisory.