Red Hat fixes multiple FreeRDP flaws enabling RCE, DoS, and proxy request injection

Red Hat released Important security updates for freerdp across multiple Red Hat Enterprise Linux product streams, including RHEL 8, 9, and 10, SAP Solutions channels, Extended Update Support, and related builder repositories. The advisories address four prominently tracked vulnerabilities: CVE-2026-64624, which allows arbitrary code execution through malicious .rdp files parsed as raw command-line options; CVE-2026-67299, a client-side heap use-after-free in asynchronous WINDOW_ICON_ORDER handling that can crash a client; CVE-2026-67289, which lets a malicious RDP server inject arbitrary headers or requests into an HTTP proxy CONNECT request via a crafted redirection target; and CVE-2026-68580, an integer overflow in audio input redirection that can cause remote code execution or denial of service.

Updated packages were published in several streams, including 2.11.7-11.el8_10 for RHEL 8, 2.11.7-7.el9_8.5, 2.11.7-1.el9_6.12, 2.11.2-1.el9_4.10, and 2.4.1-6.el9_2.11 for RHEL 9 variants, and 3.10.3-12.el10_2.8 and 3.10.3-3.el10_0.11 for RHEL 10 channels. Red Hat said the flaws can be triggered by malicious or compromised RDP servers, crafted redirection data, or specially prepared RDP files, with impacts ranging from client crashes and proxy abuse to heap corruption and code execution on affected systems.