Red Hat Product Security has published an important security advisory (RHSA-2026:4446) addressing three buffer overflow vulnerabilities in the freerdp client used in Red Hat Enterprise Linux 8.6 variants. The vulnerabilities include heap-buffer-overflow (CVE-2026-22855 and CVE-2026-22859) and global-buffer-overflow (CVE-2026-22858) issues. These flaws stem from improper memory handling in the FreeRDP implementation, which could lead to memory corruption. The advisory provides updated freerdp packages that fix these vulnerabilities. No CVSS scores are provided in the advisory, but the severity is rated as Important by Red Hat. The advisory references updated freerdp-2.2.0-7.el8_6.2 packages for multiple architectures and variants of Red Hat Enterprise Linux 8.6. No known exploits in the wild have been reported at the time of the advisory.

The vulnerabilities allow for heap and global buffer overflows in the freerdp client, which could lead to memory corruption. This may result in application crashes or potentially enable an attacker to execute arbitrary code or cause denial of service when connecting to malicious or compromised RDP servers. The impact is rated as Important by Red Hat, indicating a high security risk if unpatched. No evidence of active exploitation is currently known.

Red Hat has released updated freerdp packages (version 2.2.0-7.el8_6.2) for Red Hat Enterprise Linux 8.6 variants including AUS, E4S, and TUS. Users should apply these official updates promptly to remediate the buffer overflow vulnerabilities. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the vendor-provided patches.