FreeRDP contains multiple buffer overflow vulnerabilities, including heap-buffer-overflow (CVE-2026-22855 and CVE-2026-22859) and global-buffer-overflow (CVE-2026-22858). These issues affect the xfreerdp client component that connects to RDP servers such as Microsoft Windows, xrdp, and VirtualBox. Red Hat Product Security has released an important security advisory (RHSA-2026:4489) providing updated FreeRDP packages for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions on multiple architectures (x86_64, ppc64le, aarch64, s390x). The advisory includes references to the CVEs and instructions for applying the update. No CVSS scores are provided in the advisory, but the severity is rated as important by Red Hat.

Successful exploitation of these heap and global buffer overflow vulnerabilities could lead to memory corruption, potentially allowing an attacker to cause a denial of service or execute arbitrary code with the privileges of the affected application. The vulnerabilities affect the FreeRDP client used in Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions across multiple hardware architectures. No known exploits in the wild have been reported at this time.

Red Hat has released updated FreeRDP packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions should apply the security update as detailed in Red Hat advisory RHSA-2026:4489. The vendor manages remediation through these official patches. No additional mitigation steps are indicated in the advisory.