This advisory covers eight distinct vulnerabilities in FreeRDP as packaged for Red Hat Enterprise Linux 9.2. The issues include denial of service vulnerabilities due to use-after-free (CVE-2026-25952), double free during disconnect (CVE-2026-26986), and an endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951). Memory corruption issues include a heap-buffer-overflow in bitmap_cache_put via out-of-bounds cacheId (CVE-2026-29775), out-of-bounds read in ADPCM decoders due to missing bounds checks (CVE-2026-31885), and a division-by-zero in ADPCM decoders when nBlockAlign is zero (CVE-2026-31884). Additional denial of service via crafted audio data (CVE-2026-31883) and information disclosure via heap memory out-of-bounds read (CVE-2026-33985) are also addressed. Red Hat has issued updated packages fixing these vulnerabilities in FreeRDP version 2.4.1-6.el9_2.9 across multiple architectures including x86_64, ppc64le, aarch64, and s390x. The vendor rates the overall impact as moderate and provides official patches.

The vulnerabilities collectively allow an attacker to cause denial of service conditions through memory corruption and logic errors such as use-after-free, double free, endless loops, and crafted audio data. Additionally, heap-buffer-overflow and out-of-bounds reads can lead to memory corruption and information disclosure. A division-by-zero error can cause application crashes. These issues affect the stability and confidentiality of the FreeRDP client when connecting to RDP servers. No known exploits in the wild have been reported at this time.

Red Hat has released official security updates for FreeRDP in version 2.4.1-6.el9_2.9 for Red Hat Enterprise Linux 9.2 and related variants. Users should apply these updates promptly to remediate the vulnerabilities. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor beyond applying the provided patches.