CVE-2026-33516: xrdp is an open source RDP server. Versions through 0.10.5 contain an out-of-bounds read vulnerability during the RDP…
CVE-2026-33516 · Severity: critical · CVSS 9.1 · Published 2026-04-17
xrdp is an open source RDP server. Versions through 0.10.5 contain an out-of-bounds read vulnerability during the RDP capability exchange phase. The issue occurs when memory is accessed before validating the remaining buffer length. A remote, unauthenticated attacker can trigger this vulnerability by sending a specially crafted Confirm Active PDU. Successful exploitation could lead to a denial of service (process crash) or potential disclosure of sensitive information from the process memory. This issue has been fixed in version 0.10.6.
No. Junglewise Threat Intelligence has no report of CVE-2026-33516 being exploited in the wild.
How severe is CVE-2026-33516?
Critical severity, with a CVSS score of 9.1, published 17 April 2026.
Which products and versions are affected?
Neutrinolabs Xrdp. The advisory does not name versions.
Is there a fix for CVE-2026-33516?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2026-33516?
Check whether you run Neutrinolabs Xrdp. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.