This advisory covers ten distinct vulnerabilities in FreeRDP, including heap use-after-free during auto-reconnect (CVE-2026-25997), use-after-free (CVE-2026-25952), double free during disconnect (CVE-2026-26986), heap-buffer-overflow via out-of-bounds cacheId (CVE-2026-29775), out-of-bounds read in ADPCM decoders due to missing bounds checks (CVE-2026-31885), division-by-zero in ADPCM decoders when nBlockAlign is zero (CVE-2026-31884), denial of service via crafted audio data (CVE-2026-31883), information disclosure via heap memory out-of-bounds read (CVE-2026-33985), information disclosure and denial of service via heap-buffer-overflow read (CVE-2026-33982), and memory corruption allowing denial of service or arbitrary code execution (CVE-2026-33987). These vulnerabilities affect FreeRDP as packaged in Red Hat Enterprise Linux 10 and related builds. Red Hat has released updated packages to fix these issues as detailed in advisory RHSA-2026:16014.

The vulnerabilities can cause denial of service conditions through memory corruption issues such as use-after-free, double free, heap-buffer-overflow, out-of-bounds reads, and division-by-zero errors. Some vulnerabilities also allow information disclosure via out-of-bounds memory reads. Critically, one memory corruption vulnerability (CVE-2026-33987) may enable arbitrary code execution. These impacts affect the stability and confidentiality of systems using vulnerable FreeRDP versions.

Red Hat has released updated packages for FreeRDP in Red Hat Enterprise Linux 10 and related CodeReady Linux Builder products to address these vulnerabilities. Users should apply these official security updates as described in Red Hat advisory RHSA-2026:16014. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No other mitigations or workarounds are specified by the vendor.