FreeRDP contains multiple buffer overflow vulnerabilities, including heap-buffer-overflow (CVE-2026-22855 and CVE-2026-22859) and global-buffer-overflow (CVE-2026-22858). These vulnerabilities affect the xfreerdp client component, which is used to connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Red Hat has released updated packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support to fix these issues. The advisory rates the security impact as Important (high severity). No CVSS base score is provided in the advisory, and no known exploits in the wild have been reported at this time.

Successful exploitation of these buffer overflow vulnerabilities could potentially lead to memory corruption, which may allow an attacker to cause a denial of service or execute arbitrary code with the privileges of the affected application. The vulnerabilities affect the FreeRDP client used in Red Hat Enterprise Linux 7 Extended Lifecycle Support environments. No evidence of active exploitation has been reported.

Red Hat has released updated freerdp packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:4471 and the referenced article https://access.redhat.com/articles/11258. Since this is not a cloud service, remediation requires manual patching by system administrators. Patch status is confirmed as fixed in the updated packages provided by Red Hat.