Red Hat Product Security released an advisory (RHSA-2026:4440) addressing three security vulnerabilities in the freerdp package used in Red Hat Enterprise Linux 8.8 variants. The issues include two heap-buffer-overflow vulnerabilities (CVE-2026-22855 and CVE-2026-22859) and one global-buffer-overflow vulnerability (CVE-2026-22858). These vulnerabilities could potentially lead to memory corruption. The advisory provides updated freerdp packages (version 2.2.0-12.el8_8.2) that fix these issues. The advisory references Red Hat Bugzilla entries for each CVE and directs users to apply the update as per Red Hat's update instructions.

The vulnerabilities involve heap and global buffer overflows in the FreeRDP client, which could allow an attacker to cause memory corruption. The advisory rates the security impact as important, indicating a high severity level but does not provide a CVSS score. There are no known exploits in the wild at the time of the advisory. The impact is limited to affected versions of freerdp in Red Hat Enterprise Linux 8.8 and related update services.

Red Hat has released updated freerdp packages (version 2.2.0-12.el8_8.2) that address these buffer overflow vulnerabilities. Users of affected Red Hat Enterprise Linux 8.8 variants should apply the security update as described in the Red Hat advisory RHSA-2026:4440 and the referenced update article (https://access.redhat.com/articles/11258). No additional mitigation steps are indicated or required beyond applying the official update.