Red Hat Product Security issued an important security advisory (RHSA-2026:10076) for FreeRDP in Red Hat Enterprise Linux 8.8, addressing multiple vulnerabilities including heap-use-after-free (CVE-2026-22856, CVE-2026-24491, CVE-2026-24675, CVE-2026-24684), heap-buffer-overflow (CVE-2026-22852, CVE-2026-22854, CVE-2026-24679), NULL pointer dereference (CVE-2026-23948), denial of service via buffer overflow and use-after-free (CVE-2026-23732, CVE-2026-24676), and arbitrary code execution via crafted RDP server messages (CVE-2026-31806). The advisory covers FreeRDP packages version 2.2.0-12.el8_8.5 included in Red Hat Enterprise Linux 8.8 variants. The update mitigates these vulnerabilities by patching the affected code. No known exploits in the wild have been reported at the time of the advisory.

The vulnerabilities include memory corruption issues such as heap-use-after-free and heap-buffer-overflow, which can lead to crashes or potentially arbitrary code execution. There is also a NULL pointer dereference that may cause denial of service. The most severe vulnerability (CVE-2026-31806) allows arbitrary code execution via crafted RDP server messages, which could enable an attacker to execute code remotely on the client system. Denial of service conditions are also possible through other vulnerabilities. These issues affect the security and stability of systems using the affected FreeRDP versions.

Red Hat has released updated FreeRDP packages for Red Hat Enterprise Linux 8.8 that address these vulnerabilities. Users should apply the security update RHSA-2026:10076 promptly to remediate these issues. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory beyond applying the official update.