The Red Hat Security Advisory RHSA-2026:16865 addresses multiple vulnerabilities in FreeRDP, including CVE-2026-25952 (use-after-free leading to denial of service), CVE-2026-26986 (double free during disconnect causing denial of service), CVE-2026-27951 (endless blocking loop causing denial of service), CVE-2026-29775 (heap-buffer-overflow via out-of-bounds cacheId), CVE-2026-31885 (out-of-bounds read in ADPCM decoders due to missing bounds checks), CVE-2026-31884 (division-by-zero in ADPCM decoders when nBlockAlign is zero), CVE-2026-31883 (denial of service via crafted audio data), and CVE-2026-33985 (information disclosure via heap memory out-of-bounds read). These vulnerabilities impact the stability and confidentiality of FreeRDP when used in affected Red Hat Enterprise Linux 9.6 Extended Update Support and CodeReady Linux Builder products across multiple architectures including x86_64, s390x, ppc64le, and aarch64. The advisory provides updated packages to address these issues.

The vulnerabilities collectively can cause denial of service conditions through memory corruption (use-after-free, double free, heap-buffer-overflow), infinite loops, and crafted audio data processing. Additionally, an information disclosure vulnerability exists that could leak heap memory contents. These issues may affect the availability and confidentiality of systems using the vulnerable FreeRDP versions. No known exploits in the wild have been reported at this time.

Red Hat has released updated FreeRDP packages as part of Red Hat Enterprise Linux 9.6 Extended Update Support and related CodeReady Linux Builder products to address these vulnerabilities. Users should apply the official Red Hat security update RHSA-2026:16865 to remediate these issues. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No alternative mitigations or workarounds are specified in the advisory.