Red Hat Product Security released an advisory (RHSA-2026:3334) addressing three security vulnerabilities in FreeRDP: two heap-buffer-overflows (CVE-2026-22855 and CVE-2026-22859) and one global-buffer-overflow (CVE-2026-22858). These vulnerabilities affect the freerdp client used to connect to RDP servers. The advisory covers Red Hat Enterprise Linux 8 and related CodeReady Linux Builder packages on multiple architectures. The update to freerdp version 2.11.7-3.el8_10 includes fixes for these issues. No known exploits in the wild have been reported. The advisory rates the impact as Important (high severity) but does not provide CVSS scores. Detailed patch instructions are available from Red Hat's official update article.

Successful exploitation of these heap and global buffer overflow vulnerabilities could lead to memory corruption within the freerdp client. This may result in application crashes or potentially allow an attacker to execute arbitrary code with the privileges of the user running the client. The advisory does not specify confirmed exploitation in the wild or detailed impact scenarios but classifies the security impact as Important.

Red Hat has released an official security update for freerdp in Red Hat Enterprise Linux 8 that addresses these vulnerabilities. Users and administrators should apply the freerdp update (version 2.11.7-3.el8_10 or later) as provided by Red Hat to remediate these issues. Refer to Red Hat's official update article (https://access.redhat.com/articles/11258) for detailed instructions on applying the update. No additional mitigation steps are indicated or required beyond applying the official patch.