FreeRDP, an open-source RDP client used to connect to RDP servers including Microsoft Windows, xrdp, and VirtualBox, contains multiple buffer overflow vulnerabilities: heap-buffer-overflow (CVE-2026-22855 and CVE-2026-22859) and global-buffer-overflow (CVE-2026-22858). These vulnerabilities could potentially lead to memory corruption issues. Red Hat has issued an update for freerdp in Red Hat Enterprise Linux 9.4 Extended Update Support and associated builds to fix these vulnerabilities. The advisory does not provide CVSS scores but rates the impact as Important. No known exploits in the wild have been reported at this time.

The vulnerabilities involve heap and global buffer overflows in the freerdp client, which could allow an attacker to cause memory corruption. This may lead to denial of service or potentially arbitrary code execution if exploited. The advisory classifies the impact as Important, indicating a high severity level. No known active exploitation has been reported.

Red Hat has released updated freerdp packages that fix these vulnerabilities. Users of affected Red Hat Enterprise Linux 9.4 Extended Update Support and related variants should apply the provided security updates promptly. Detailed update instructions are available in the Red Hat advisory and article referenced. Since this is an on-premises package, remediation requires manual update by system administrators.