Red Hat Product Security has released an important security advisory (RHSA-2026:6340) addressing multiple vulnerabilities in FreeRDP, including heap-use-after-free (CVE-2026-22856, CVE-2026-24491, CVE-2026-24675, CVE-2026-24681, CVE-2026-24683, CVE-2026-24684), heap-buffer-overflow (CVE-2026-22852, CVE-2026-22854, CVE-2026-24679), NULL pointer dereference (CVE-2026-23948), denial of service via buffer overflow and use-after-free (CVE-2026-23732, CVE-2026-24676), and arbitrary code execution via crafted RDP server messages (CVE-2026-31806). These vulnerabilities affect the FreeRDP client implementation used in Red Hat Enterprise Linux 9 and related CodeReady Linux Builder products across multiple architectures. The advisory provides updated packages to remediate these issues.

The vulnerabilities collectively can lead to denial of service conditions, crashes, and potentially arbitrary code execution when interacting with malicious or crafted RDP server messages. This could allow an attacker to execute code remotely on affected systems running vulnerable versions of FreeRDP. The advisory rates the security impact as Important (high severity). No known exploits in the wild have been reported at this time.

Red Hat has released updated packages for FreeRDP as part of Red Hat Enterprise Linux 9 and related products to address these vulnerabilities. Users should apply the security updates provided in advisory RHSA-2026:6340 promptly. For detailed instructions on applying the update, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor beyond applying the official patches.