The Red Hat security advisory RHSA-2026:16777 addresses eight vulnerabilities in FreeRDP, including CVE-2026-25952 (use-after-free leading to denial of service), CVE-2026-26986 (double free during disconnect causing denial of service), CVE-2026-27951 (endless blocking loop causing denial of service), CVE-2026-29775 (heap-buffer-overflow via out-of-bounds cacheId), CVE-2026-31885 (out-of-bounds read in ADPCM decoders due to missing bounds checks), CVE-2026-31884 (division-by-zero in ADPCM decoders when nBlockAlign is zero), CVE-2026-31883 (denial of service via crafted audio data), and CVE-2026-33985 (information disclosure via heap memory out-of-bounds read). These vulnerabilities affect FreeRDP versions as packaged in Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Telecommunications Update Service. The advisory provides updated packages to remediate these issues.

The vulnerabilities can lead to denial of service conditions through memory corruption and logic errors such as use-after-free, double free, endless loops, and crafted input handling. Additionally, there is a heap-buffer-overflow and out-of-bounds memory reads that may cause crashes or potentially expose sensitive information. A division-by-zero error can also cause crashes. The information disclosure vulnerability allows reading heap memory out of bounds, potentially leaking sensitive data. No known exploits in the wild have been reported at this time.

Red Hat has released updated freerdp packages for Red Hat Enterprise Linux 8.8 variants that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:16777 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.