SB20260408150 - Red Hat Enterprise Linux 9 update for freerdp

Description

This security bulletin contains information about 13 secuirty vulnerabilities.

1) Use-after-free (CVE-ID: CVE-2026-22856)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in create_irp_thread() function. A remote attacker can trick the victim into connecting to a malicious server and execute arbitrary code on the system.

2) Heap-based buffer overflow (CVE-ID: CVE-2026-22854)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in drive_process_irp_read() function. A remote attacker can trick the victim into connecting to a malicious server, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

3) Out-of-bounds write (CVE-ID: CVE-2026-22852)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input within the audin_process_formats() function. A remote attacker can trick the victim into connecting to a malicious server, trigger an out-of-bounds write and execute arbitrary code on the target system.

4) Heap-based buffer overflow (CVE-ID: CVE-2026-23732)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Glyph_Alloc. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

5) Use-after-free (CVE-ID: CVE-2026-24676)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in audio_format_compatible() function. A remote attacker can trick the victim into connecting to a malicious server and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

6) Use-after-free (CVE-ID: CVE-2026-24491)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in video_timer() function. A remote attacker can trick the victim into connecting to a malicious server and execute arbitrary code on the system.

7) NULL pointer dereference (CVE-ID: CVE-2026-23948)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in rdp_write_logon_info_v2(). A remote attacker can trick the victim into connecting to a malicious server and crash the application.

8) Use-after-free (CVE-ID: CVE-2026-24684)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in play_thread() function. A remote attacker can trick the victim into connecting to a malicious server and execute arbitrary code on the system.

9) Use-after-free (CVE-ID: CVE-2026-24681)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in urb_bulk_transfer_cb() function. A remote attacker can trick the victim into connecting to a malicious server and execute arbitrary code on the system.

10) Use-after-free (CVE-ID: CVE-2026-24683)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in ainput_send_input_event() function. A remote attacker can trick the victim into connecting to a malicious server and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

11) Heap-based buffer overflow (CVE-ID: CVE-2026-24679)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in urb_select_interface() function. A remote attacker can trick the victim into connecting to a malicious server, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

12) Use-after-free (CVE-ID: CVE-2026-24675)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in urb_select_interface() function. A remote attacker can trick the victim into connecting to a malicious server and execute arbitrary code on the system.

13) Heap-based buffer overflow (CVE-ID: CVE-2026-31806)

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in nsc_process_message() when processing SURFACE_BITS_COMMAND messages using NSCodec. A remote attacker can send a specially crafted RDP server message with oversized bitmap dimensions to execute arbitrary code.

The issue can be triggered when a FreeRDP client connects to a malicious RDP server.

Remediation

Install update from vendor's website.

References

• https://access.redhat.com/errata/RHSA-2026:6958