Quick answers
- Is CVE-2026-41521 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-41521 being exploited in the wild.
- How severe is CVE-2026-41521?
- High severity, with a CVSS score of 8.2, published 20 July 2026.
- Which products and versions are affected?
- Neutrinolabs Xrdp <= 0.10.6.
- Is there a fix for CVE-2026-41521?
- A patch was published on 2026-07-06: Version 0.10.6.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-41521 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-41521?
- Check whether you run Neutrinolabs Xrdp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An integer overflow vulnerability exists in xrdp versions 0.10.6 and prior when processing screen update messages in the 'vnc-any' connection mode. A malicious remote VNC server can provide crafted image dimensions that cause an integer overflow during memory buffer size calculation, leading to an undersized heap allocation. When the system subsequently processes the image data using the original oversized parameters, it performs an out-of-bounds read. This can be exploited by an unauthenticated remote attacker to disclose sensitive heap memory or cause a process crash (DoS). The issue is fixed in version 0.10.6.1; as a mitigation, users can disable the [vnc-any] section in xrdp.ini.
Affected products
- neutrinolabs xrdp <= 0.10.6
Timeline
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-06: patched: Version 0.10.6.1 released
- 2026-07-20: disclosed: NVD publication date