Executive brief
xrdp is an open-source tool that allows users to remotely access Linux desktops using the Remote Desktop Protocol (RDP). A security flaw in its FIPS-compliant encryption mode allows an unauthenticated attacker to crash the specific connection process by sending a specially crafted message. While this can disrupt an individual user's session, it typically does not crash the entire remote desktop service or expose private data.
Technical details
A heap out-of-bounds read exists in xrdp versions 0.10.6 and prior due to improper input validation of the FIPS padding length field. When the security layer is configured as 'negotiate' or 'rdp' and 'crypt_level' is set to 'fips' in xrdp.ini, the server fails to validate padding lengths in incoming PDUs. This leads to a pointer underflow and a subsequent negative length calculation during processing. An unauthenticated remote attacker can trigger this by sending a crafted FIPS-protected PDU, resulting in a process crash. Because xrdp forks a new process per connection, the impact is limited to a denial of service for the specific session rather than the entire daemon. The issue is fixed in version 0.10.6.1.
Affected products
- neutrinolabs xrdp <= 0.10.6
Timeline
- 2026-07-01: advisory: GitHub Security Advisory published
- 2026-07-06: patched: Version 0.10.6.1 released
- 2026-07-20: disclosed: CVE-2026-44978 published to NVD