Red Hat Product Security has issued an important security advisory (RHSA-2026:4437) for FreeRDP, addressing three buffer overflow vulnerabilities: two heap-buffer-overflows (CVE-2026-22855 and CVE-2026-22859) and one global-buffer-overflow (CVE-2026-22858). These vulnerabilities affect the freerdp client used to connect to RDP servers. The advisory covers Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions and Extended Life Cycle variants on multiple architectures. The advisory references updated freerdp packages (version 2.4.1-6.el9_2.3) that include fixes for these issues. No CVSS scores are provided in the advisory, and no known exploits in the wild have been reported at this time.

The vulnerabilities involve heap and global buffer overflows in FreeRDP, which could potentially lead to memory corruption. Such issues may allow an attacker to cause a denial of service or possibly execute arbitrary code if exploited. However, no known exploits in the wild have been reported. The impact is rated as important by Red Hat, indicating a significant security concern requiring attention.

Red Hat has released updated freerdp packages that fix these vulnerabilities. Users of affected Red Hat Enterprise Linux 9.2 versions and related variants should apply the security update as described in Red Hat advisory RHSA-2026:4437. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.