FreeRDP, an open-source RDP client used to connect to various RDP servers, contains multiple buffer overflow vulnerabilities including heap-buffer-overflow (CVE-2026-22855 and CVE-2026-22859) and global-buffer-overflow (CVE-2026-22858). These vulnerabilities were identified and fixed in the freerdp package distributed with Red Hat Enterprise Linux 9.2. The advisory from Red Hat (RHSA-2026:4437) rates the security impact as Important and provides updated packages to remediate these issues. The vulnerabilities correspond to CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write). No CVSS scores are provided in the advisory, and no known exploits in the wild have been reported at this time.

The vulnerabilities involve buffer overflows in FreeRDP, which could potentially lead to memory corruption. Such issues may allow an attacker to cause a denial of service or possibly execute arbitrary code if exploited. The advisory classifies the impact as Important, indicating a significant security risk if left unpatched. However, no active exploitation has been reported.

Red Hat has released updated freerdp packages for Red Hat Enterprise Linux 9.2 and related variants that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:4437 and the referenced article https://access.redhat.com/articles/11258 to remediate the issues. Since this is a traditional software package, remediation requires applying the vendor-provided patch. No additional mitigation steps are indicated by the vendor.