diff --git a/SOURCES/codec-clear-update-CLEAR_VBAR_ENTRY-size-after-alloc.patch b/SOURCES/codec-clear-update-CLEAR_VBAR_ENTRY-size-after-alloc.patch
new file mode 100644
index 0000000..3ffe84a
--- /dev/null
+++ b/SOURCES/codec-clear-update-CLEAR_VBAR_ENTRY-size-after-alloc.patch
@@ -0,0 +1,35 @@
+From a2dde6d9832cb032e8cf12cab3da84dafbab9006 Mon Sep 17 00:00:00 2001
+From: Ondrej Holy <oholy@redhat.com>
+Date: Fri, 10 Apr 2026 11:32:09 +0200
+Subject: [PATCH] [codec,clear] update CLEAR_VBAR_ENTRY::size after alloc
+
+Backport of commit a2dde6d9832cb032e8cf12cab3da84dafbab9006.
+
+Made-with: Cursor
+---
+ libfreerdp/codec/clear.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libfreerdp/codec/clear.c b/libfreerdp/codec/clear.c
+index e38fa0d..eda30ad 100644
+--- a/libfreerdp/codec/clear.c
++++ b/libfreerdp/codec/clear.c
+@@ -565,7 +565,6 @@ static BOOL resize_vbar_entry(CLEAR_CONTEXT* clear, CLEAR_VBAR_ENTRY* vBarEntry)
+ 		const UINT32 oldPos = vBarEntry->size * bpp;
+ 		const UINT32 diffSize = (vBarEntry->count - vBarEntry->size) * bpp;
+ 		BYTE* tmp;
+-		vBarEntry->size = vBarEntry->count;
+ 		tmp = (BYTE*)realloc(vBarEntry->pixels, 1ull * vBarEntry->count * bpp);
+ 
+ 		if (!tmp)
+@@ -576,6 +575,7 @@ static BOOL resize_vbar_entry(CLEAR_CONTEXT* clear, CLEAR_VBAR_ENTRY* vBarEntry)
+ 
+ 		memset(&tmp[oldPos], 0, diffSize);
+ 		vBarEntry->pixels = tmp;
++		vBarEntry->size = vBarEntry->count;
+ 	}
+ 
+ 	if (!vBarEntry->pixels && vBarEntry->size)
+-- 
+2.49.0
+
diff --git a/SOURCES/codec-progressive-fail-progressive_rfx_quant_sub-on-invalid-values.patch b/SOURCES/codec-progressive-fail-progressive_rfx_quant_sub-on-invalid-values.patch
new file mode 100644
index 0000000..3f02417
--- /dev/null
+++ b/SOURCES/codec-progressive-fail-progressive_rfx_quant_sub-on-invalid-values.patch
@@ -0,0 +1,89 @@
+From 78188ab479c8e6eb9ba2475b3732c76b4bbe5425 Mon Sep 17 00:00:00 2001
+From: Ondrej Holy <oholy@redhat.com>
+Date: Mon, 13 Apr 2026 14:00:00 +0200
+Subject: [PATCH] [codec,progressive] Fail progressive_rfx_quant_sub on invalid
+ values
+
+Backport of commit 78188ab479c8e6eb9ba2475b3732c76b4bbe5425.
+
+Made-with: Cursor
+---
+ libfreerdp/codec/progressive.c | 42 ++++++++++++++++++++++++++++++----
+ 1 file changed, 38 insertions(+), 4 deletions(-)
+
+diff --git a/libfreerdp/codec/progressive.c b/libfreerdp/codec/progressive.c
+index 8894b35..bbcc921 100644
+--- a/libfreerdp/codec/progressive.c
++++ b/libfreerdp/codec/progressive.c
+@@ -155,20 +155,51 @@ static INLINE void progressive_rfx_quant_lsub(RFX_COMPONENT_CODEC_QUANT* q, int
+ 	q->LL3 -= val; /* LL3 */
+ }
+ 
+-static INLINE void progressive_rfx_quant_sub(const RFX_COMPONENT_CODEC_QUANT* q1,
++static INLINE BOOL progressive_rfx_quant_sub(const RFX_COMPONENT_CODEC_QUANT* q1,
+                                              const RFX_COMPONENT_CODEC_QUANT* q2,
+                                              RFX_COMPONENT_CODEC_QUANT* dst)
+ {
++	if (q1->HH1 < q2->HL1)
++		return FALSE;
+ 	dst->HL1 = q1->HL1 - q2->HL1; /* HL1 */
++
++	if (q1->LH1 < q2->LH1)
++		return FALSE;
+ 	dst->LH1 = q1->LH1 - q2->LH1; /* LH1 */
++
++	if (q1->HH1 < q2->HH1)
++		return FALSE;
+ 	dst->HH1 = q1->HH1 - q2->HH1; /* HH1 */
++
++	if (q1->HL2 < q2->HL2)
++		return FALSE;
+ 	dst->HL2 = q1->HL2 - q2->HL2; /* HL2 */
++
++	if (q1->LH2 < q2->LH2)
++		return FALSE;
+ 	dst->LH2 = q1->LH2 - q2->LH2; /* LH2 */
++
++	if (q1->HH2 < q2->HH2)
++		return FALSE;
+ 	dst->HH2 = q1->HH2 - q2->HH2; /* HH2 */
++
++	if (q1->HL3 < q2->HL3)
++		return FALSE;
+ 	dst->HL3 = q1->HL3 - q2->HL3; /* HL3 */
++
++	if (q1->LH3 < q2->LH3)
++		return FALSE;
+ 	dst->LH3 = q1->LH3 - q2->LH3; /* LH3 */
++
++	if (q1->HH3 < q2->HH3)
++		return FALSE;
+ 	dst->HH3 = q1->HH3 - q2->HH3; /* HH3 */
++
++	if (q1->LL3 < q2->LL3)
++		return FALSE;
+ 	dst->LL3 = q1->LL3 - q2->LL3; /* LL3 */
++
++	return TRUE;
+ }
+ 
+ static INLINE BOOL progressive_rfx_quant_lcmp_less_equal(const RFX_COMPONENT_CODEC_QUANT* q,
+@@ -1433,9 +1464,12 @@ static INLINE int progressive_decompress_tile_upgrade(PROGRESSIVE_CONTEXT* progr
+ 	progressive_rfx_quant_add(quantY, quantProgY, &yBitPos);
+ 	progressive_rfx_quant_add(quantCb, quantProgCb, &cbBitPos);
+ 	progressive_rfx_quant_add(quantCr, quantProgCr, &crBitPos);
+-	progressive_rfx_quant_sub(&(tile->yBitPos), &yBitPos, &yNumBits);
+-	progressive_rfx_quant_sub(&(tile->cbBitPos), &cbBitPos, &cbNumBits);
+-	progressive_rfx_quant_sub(&(tile->crBitPos), &crBitPos, &crNumBits);
++	if (!progressive_rfx_quant_sub(&(tile->yBitPos), &yBitPos, &yNumBits))
++		goto fail;
++	if (!progressive_rfx_quant_sub(&(tile->cbBitPos), &cbBitPos, &cbNumBits))
++		goto fail;
++	if (!progressive_rfx_quant_sub(&(tile->crBitPos), &crBitPos, &crNumBits))
++		goto fail;
+ 	progressive_rfx_quant_add(quantY, quantProgY, &shiftY);
+ 	progressive_rfx_quant_lsub(&shiftY, 1); /* -6 + 5 = -1 */
+ 	progressive_rfx_quant_add(quantCb, quantProgCb, &shiftCb);
+-- 
+2.49.0
+
diff --git a/SOURCES/codec-progressive-fix-underflow-guard-in-progressive_rfx_quant_sub.patch b/SOURCES/codec-progressive-fix-underflow-guard-in-progressive_rfx_quant_sub.patch
new file mode 100644
index 0000000..acb6af7
--- /dev/null
+++ b/SOURCES/codec-progressive-fix-underflow-guard-in-progressive_rfx_quant_sub.patch
@@ -0,0 +1,29 @@
+From 78677dc6e262f46937d00c3aa52381e4bb198fa5 Mon Sep 17 00:00:00 2001
+From: Ondrej Holy <oholy@redhat.com>
+Date: Mon, 13 Apr 2026 14:00:00 +0200
+Subject: [PATCH] [codec,progressive] fix underflow guard in
+ progressive_rfx_quant_sub
+
+Backport of commit 78677dc6e262f46937d00c3aa52381e4bb198fa5.
+
+Made-with: Cursor
+---
+ libfreerdp/codec/progressive.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libfreerdp/codec/progressive.c b/libfreerdp/codec/progressive.c
+index bbcc921..1234567 100644
+--- a/libfreerdp/codec/progressive.c
++++ b/libfreerdp/codec/progressive.c
+@@ -158,7 +158,7 @@ static INLINE BOOL progressive_rfx_quant_sub(const RFX_COMPONENT_CODEC_QUANT* q1
+                                              const RFX_COMPONENT_CODEC_QUANT* q2,
+                                              RFX_COMPONENT_CODEC_QUANT* dst)
+ {
+-	if (q1->HH1 < q2->HL1)
++	if (q1->HL1 < q2->HL1)
+ 		return FALSE;
+ 	dst->HL1 = q1->HL1 - q2->HL1; /* HL1 */
+ 
+-- 
+2.49.0
+
diff --git a/SPECS/freerdp.spec b/SPECS/freerdp.spec
index 6994003..697e298 100644
--- a/SPECS/freerdp.spec
+++ b/SPECS/freerdp.spec
@@ -27,7 +27,7 @@
 
 Name:           freerdp
 Version:        2.11.7
-Release:        1%{?dist}.5
+Release:        1%{?dist}.6
 Epoch:          2
 Summary:        Free implementation of the Remote Desktop Protocol (RDP)
 License:        ASL 2.0
@@ -140,6 +140,16 @@ Patch:          channel-rdpsnd-only-clean-up-thread-before-free.patch
 Patch:          codec-nsc-limit-copy-area-in-nsc_process_message.patch
 Patch:          codec-nsc-fix-use-of-nsc_process_message.patch
 
+# CVE-2026-33984
+# https://github.com/FreeRDP/FreeRDP/commit/a2dde6d9832cb032e8cf12cab3da84dafbab9006
+Patch:          codec-clear-update-CLEAR_VBAR_ENTRY-size-after-alloc.patch
+
+# CVE-2026-33983
+# https://github.com/FreeRDP/FreeRDP/commit/78188ab479c8e6eb9ba2475b3732c76b4bbe5425
+# https://github.com/FreeRDP/FreeRDP/commit/78677dc6e262f46937d00c3aa52381e4bb198fa5
+Patch:          codec-progressive-fail-progressive_rfx_quant_sub-on-invalid-values.patch
+Patch:          codec-progressive-fix-underflow-guard-in-progressive_rfx_quant_sub.patch
+
 BuildRequires:  gcc
 BuildRequires:  gcc-c++
 BuildRequires:  alsa-lib-devel
@@ -397,6 +407,11 @@ find %{buildroot} -name "*.a" -delete
 %{_libdir}/pkgconfig/winpr-tools2.pc
 
 %changelog
+* Fri Apr 10 2026 Ondrej Holy <oholy@redhat.com> - 2:2.11.7-1.6
+- Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984)
+- Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983)
+  Resolves: RHEL-162958, RHEL-162978
+
 * Tue Mar 31 2026 Ondrej Holy <oholy@redhat.com> - 2:2.11.7-1.5
 - Fix use of nsc_process_message
   Resolves: RHEL-155993