FreeRDP contains two vulnerabilities: a heap buffer overflow (CVE-2026-33984) that enables arbitrary code execution when processing crafted pixel data, and a denial of service vulnerability (CVE-2026-33983) caused by specially crafted Remote Desktop Protocol messages. These issues affect the xfreerdp client used to connect to RDP servers. Red Hat has released a security update for FreeRDP in Red Hat Enterprise Linux 9, specifically version 2.11.7-1.el9_7.6, which addresses these vulnerabilities. The advisory rates the impact as Important and provides updated packages for multiple architectures and variants of Red Hat Enterprise Linux 9. No CVSS scores are provided in the advisory, but the impact includes potential code execution and service disruption.

Successful exploitation of CVE-2026-33984 could allow an attacker to execute arbitrary code on the affected system via crafted pixel data sent to the FreeRDP client. CVE-2026-33983 could allow an attacker to cause a denial of service by sending specially crafted RDP messages, potentially disrupting the availability of the FreeRDP client. These vulnerabilities impact systems running the affected FreeRDP versions on Red Hat Enterprise Linux 9 and related variants.

Red Hat has released an official security update (freerdp-2.11.7-1.el9_7.6 and related packages) that fixes these vulnerabilities. Users should apply the update as described in the Red Hat advisory RHSA-2026:8457 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory. Systems updated to the fixed package versions are protected against these vulnerabilities.