Red Hat Security Advisory: freerdp security update

The advisory covers two security flaws in FreeRDP used in Red Hat Enterprise Linux 9 and related products. CVE-2026-33984 is a heap buffer overflow vulnerability that can lead to arbitrary code execution when processing crafted pixel data. CVE-2026-33983 is a denial of service vulnerability triggered by specially crafted Remote Desktop Protocol messages. Red Hat has released patches for these vulnerabilities in FreeRDP version 2.11.7-7.el9_8.1 and related packages. The advisory rates the impact as Important and provides detailed package updates for multiple architectures including x86_64, s390x, ppc64le, and aarch64.

Successful exploitation of CVE-2026-33984 could allow an attacker to execute arbitrary code on the affected system via crafted pixel data in RDP sessions. CVE-2026-33983 could cause denial of service by crashing or disrupting the FreeRDP client through maliciously crafted RDP messages. These vulnerabilities impact systems running FreeRDP on Red Hat Enterprise Linux 9 and related variants, potentially affecting remote desktop client security and availability.

Red Hat has released an official security update that addresses these vulnerabilities. Users should apply the FreeRDP update provided in Red Hat Enterprise Linux 9 and related packages as detailed in Red Hat Advisory RHSA-2026:19349. For update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patch.