FreeRDP in Red Hat Enterprise Linux 9 and related CodeReady Linux Builder products contains multiple security vulnerabilities: CVE-2026-25952 (use-after-free leading to denial of service), CVE-2026-26986 (double free during disconnect causing denial of service), CVE-2026-27951 (endless blocking loop causing denial of service), CVE-2026-29775 (heap-buffer-overflow via out-of-bounds cacheId), CVE-2026-31885 (out-of-bounds read in ADPCM decoders due to missing bounds checks), CVE-2026-31884 (division-by-zero in ADPCM decoders when nBlockAlign is zero), CVE-2026-31883 (denial of service via crafted audio data), and CVE-2026-33985 (information disclosure via heap memory out-of-bounds read). Red Hat has released updated packages to address these issues as detailed in advisory RHSA-2026:16482.

The vulnerabilities can lead to denial of service conditions through memory corruption issues such as use-after-free, double free, endless loops, and crafted audio data. Additionally, heap-buffer-overflow and out-of-bounds reads can cause crashes or potentially expose sensitive information via memory disclosure. A division-by-zero error can also cause application crashes. These issues affect the stability and confidentiality of systems running vulnerable FreeRDP versions.

Red Hat has released updated freerdp packages for Red Hat Enterprise Linux 9 and related CodeReady Linux Builder products that address these vulnerabilities. Users should apply the security update described in Red Hat advisory RHSA-2026:16482 promptly. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches.