FreeRDP, an open-source RDP client, contains multiple security vulnerabilities including denial of service from use-after-free (CVE-2026-25952), double free during disconnect (CVE-2026-26986), and endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951). It also suffers from a heap-buffer-overflow via out-of-bounds cacheId in bitmap_cache_put (CVE-2026-29775), out-of-bounds read in ADPCM decoders due to missing bounds checks (CVE-2026-31885), division-by-zero in ADPCM decoders when nBlockAlign is zero (CVE-2026-31884), denial of service via crafted audio data (CVE-2026-31883), and information disclosure through heap memory out-of-bounds read (CVE-2026-33985). These vulnerabilities were addressed in updated packages released by Red Hat for Red Hat Enterprise Linux 8.8 and associated update services as detailed in advisory RHSA-2026:16777.

The vulnerabilities collectively allow an attacker to cause denial of service conditions through memory corruption, infinite loops, and crafted input data. Additionally, there is potential for information disclosure via out-of-bounds memory reads. These issues could disrupt RDP client operations and potentially expose sensitive memory contents. No known exploits in the wild have been reported at this time.

Red Hat has released updated packages for FreeRDP in Red Hat Enterprise Linux 8.8 and related update services that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:16777 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.