FreeRDP contains multiple buffer overflow vulnerabilities, specifically heap-buffer-overflow (CVE-2026-22855 and CVE-2026-22859) and global-buffer-overflow (CVE-2026-22858). These vulnerabilities affect the xfreerdp client component, which connects to RDP servers such as Microsoft Windows, xrdp, and VirtualBox. Red Hat has released security updates for Red Hat Enterprise Linux 7 Extended Lifecycle Support to fix these issues. The advisory references bugzilla entries for each CVE and provides updated package versions for multiple architectures including x86_64, s390x, ppc64, and ppc64le. No CVSS scores are provided in the advisory, but the impact is rated as important.

The identified buffer overflow vulnerabilities could potentially allow an attacker to cause memory corruption in the FreeRDP client, which may lead to denial of service or other unintended behavior. The advisory does not provide explicit details on exploitation or active exploitation in the wild. The impact is rated as important by Red Hat, indicating significant security concerns but no confirmed active exploitation.

Red Hat has released updated freerdp packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support that address these vulnerabilities. Users should apply the provided security updates as described in Red Hat advisory RHSA-2026:4471 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches.