RHSA-2026:98598: Critical: freerdp security, bug fix, and enhancement update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.Security Fix(es): FreeRDP: freerdp-proxy: FreeRDP: Information disclosure via uninitialized heap memory in Save Session Info PDU (CVE-2026-85089) FreeRDP: FreeRDP: Arbitrary code execution via oversized channel messages in SHOWPROTOCOL (CVE-2026-91948) FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954) FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU (CVE-2026-91964) FreeRDP: FreeRDP: Information Disclosure via RDPGFX ResetGraphics PDU (CVE-2026-91946) freerdp: FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass (CVE-2026-91949) FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956) FreeRDP: FreeRDP: Denial of Service via out-of-bounds write in urbdrc client channel (CVE-2026-91951) FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963) FreeRDP: FreeRDP: Use-after-free vulnerability in DRDYNVC parser leads to memory corruption (CVE-2026-91947) FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959) FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service or information disclosure (CVE-2026-91950) FreeRDP: FreeRDP: Denial of Service via integer overflow and double free in WinPR (CVE-2026-91960) FreeRDP: FreeRDP: Heap buffer overflow via oversized LBLOADBALANCEINFO routing token can lead to heap corruption. (CVE-2026-91953) FreeRDP: FreeRDP: Denial of Service due to out-of-bounds read in smartcard response processing (CVE-2026-91945) freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling (CVE-2026-109242) freerdp: FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect (CVE-2026-109676) freerdp: FreeRDP: Unauthenticated keystroke injection via premature input dispatch (CVE-2026-110838) freerdp: freerdp: Denial of Service via file descriptor exhaustion in serial device handling (CVE-2026-110830) freerdp: freerdp: Denial of Service via heap-based buffer overflow during MP3 audio decoding (CVE-2026-110837) freerdp: freerdp: Denial of Service via unbounded memory consumption during RDPDR reassembly (CVE-2026-110833) freerdp: FreeRDP: Denial of Service via grayscale JPEG clipboard conversion (CVE-2026-110839) freerdp: freerdp: Denial of Service via memory exhaustion in NLA frame parser (CVE-2026-111378) freerdp: FreeRDP: Arbitrary code execution via crafted persistent cache file (CVE-2026-111379) freerdp: freerdp: Arbitrary code execution via crafted persistent cache file (CVE-2026-111381) freerdp: freerdp: Arbitrary code execution via crafted display frames (CVE-2026-111382) freerdp: freerdp: Denial of Service via heap out-of-bounds write in NTLM authentication (CVE-2026-111880) freerdp: FreeRDP: heap buffer overflow in server rdpsnd via crafted audio formats (CVE-2026-114045) freerdp: FreeRDP: Denial of Service via malformed image clipboard payloads (CVE-2026-121386) freerdp: freerdp: Denial of Service via zero-width graphics reset (CVE-2026-121402) freerdp: freerdp: Denial of Service via zero-length dynamic virtual channel messages (CVE-2026-121404) freerdp: freerdp: Denial of Service via uncontrolled memory allocation in dynamic virtual channels (CVE-2026-121388) freerdp: FreeRDP: Denial of Service via assertion failure in RemoteFX decoder (CVE-2026-121394) Bug Fix(es) and Enhancement(s): Rebase FreeRDP to 3.32.2 or newer [rhel-10.3.z] (JIRA:RHEL-277443) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.