This advisory covers a set of ten security vulnerabilities in FreeRDP, including CVE-2026-25952 and nine others, that affect the FreeRDP client implementation. The flaws include heap use-after-free during auto-reconnect, use-after-free, double free during disconnect, heap-buffer-overflow via out-of-bounds cacheId, out-of-bounds read in ADPCM decoders due to missing bounds checks, division-by-zero in ADPCM decoders, denial of service via crafted audio data, information disclosure via heap out-of-bounds read, and memory corruption that may allow denial of service or arbitrary code execution. These vulnerabilities impact the FreeRDP packages distributed with Red Hat Enterprise Linux 10.0 Extended Update Support and related CodeReady Linux Builder products across multiple CPU architectures (x86_64, s390x, ppc64le, aarch64). Red Hat has issued updated freerdp packages (version 3.10.3-3.el10_0.7) that address these vulnerabilities. The advisory rates the security impact as Moderate (medium severity).

The vulnerabilities collectively allow an attacker to cause denial of service conditions through various memory corruption issues such as use-after-free, double free, heap-buffer-overflow, out-of-bounds reads, and division-by-zero errors. Some vulnerabilities also allow information disclosure via out-of-bounds heap reads. One memory corruption vulnerability could potentially allow arbitrary code execution, increasing the risk beyond denial of service. These issues affect the FreeRDP client used to connect to RDP servers, potentially impacting systems running vulnerable versions of FreeRDP on Red Hat Enterprise Linux 10.0 Extended Update Support and related products.

Red Hat has released updated FreeRDP packages (version 3.10.3-3.el10_0.7) that fix all listed vulnerabilities. Users of affected Red Hat Enterprise Linux 10.0 Extended Update Support and CodeReady Linux Builder products should apply these updates promptly. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official patches.