This advisory covers multiple vulnerabilities in FreeRDP, including heap-use-after-free (CVE-2026-22856, CVE-2026-24491), heap-buffer-overflow (CVE-2026-22852, CVE-2026-22854, CVE-2026-24679), denial of service via buffer overflow and use-after-free (CVE-2026-23732, CVE-2026-24676), NULL pointer dereference (CVE-2026-23948), and arbitrary code execution via crafted RDP server messages (CVE-2026-31806). These issues affect the xfreerdp client component of FreeRDP, which connects to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. The vulnerabilities are addressed in updated packages provided by Red Hat for Red Hat Enterprise Linux 8.2 AUS. The advisory references nine CVEs and multiple bugzilla fixes. No CVSS scores are provided in the advisory.

The vulnerabilities include memory corruption issues such as heap-use-after-free and heap-buffer-overflow, which can lead to denial of service or potentially arbitrary code execution. The presence of a NULL pointer dereference can cause application crashes. The arbitrary code execution vulnerability (CVE-2026-31806) allows execution of crafted RDP server messages, which could enable an attacker to execute code remotely on affected clients. These issues collectively pose a high security risk to systems running the affected FreeRDP versions.

Red Hat has released updated packages for FreeRDP in Red Hat Enterprise Linux 8.2 AUS (freerdp-2.0.0-46.rc4.el8_2.10) that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:10734 and the referenced article https://access.redhat.com/articles/11258. No indication is given that the vulnerabilities are already mitigated or require no action; therefore, applying the official update is the recommended remediation.