Executive brief
xrdp is an open-source tool that allows users to remotely access Linux desktops using the Remote Desktop Protocol (RDP). A critical security flaw in its 'vnc-any' mode allows a malicious server to crash the system or potentially take full control of the machine. This could lead to a total service outage or unauthorized access to sensitive data before a user even logs in.
Technical details
A heap-based buffer overflow (CWE-122) exists in xrdp versions 0.10.6 and prior when operating in 'vnc-any' mode. The vulnerability is rooted in the handling of Remote Framebuffer (RFB) protocol color map messages, where incoming color indices from a VNC server are not properly validated against allocated buffer boundaries. An attacker-controlled or malicious VNC server can send crafted messages with out-of-range values to trigger an out-of-bounds write on the heap. This can be exploited over the network without authentication to achieve remote code execution (RCE) or a denial of service (DoS). The issue is resolved in version 0.10.6.1.
Affected products
- neutrinolabs xrdp <= 0.10.6
Timeline
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-06: patched: Version 0.10.6.1 released
- 2026-07-20: disclosed: CVE-2026-41252 published to NVD