Is CVE-2026-44978 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44978 being exploited in the wild.

How severe is CVE-2026-44978?

Medium severity, with a CVSS score of 5.3, published 20 July 2026.

Is there a fix for CVE-2026-44978?

A patch was published on 2026-07-06: Version 0.10.6.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44978 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-44978?

Check whether you run Neutrinolabs Xrdp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44978: neutrinolabs xrdp heap out-of-bounds read in FIPS receive paths

CVE-2026-44978 · Severity: medium · CVSS 5.3 · Published 2026-07-20

xrdp is an open-source tool that allows users to remotely access Linux desktops using the Remote Desktop Protocol (RDP). A security flaw in its FIPS-compliant encryption mode allows an unauthenticated attacker to crash the specific connection process by sending a specially crafted message. While this can disrupt an individual user's session, it typically does not crash the entire remote desktop service or expose private data.

Technologies: Neutrinolabs Xrdp. Vendors: Neutrinolabs.

Quick answers

Is CVE-2026-44978 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44978 being exploited in the wild.
How severe is CVE-2026-44978?: Medium severity, with a CVSS score of 5.3, published 20 July 2026.
Which products and versions are affected?: Neutrinolabs Xrdp <= 0.10.6.
Is there a fix for CVE-2026-44978?: A patch was published on 2026-07-06: Version 0.10.6.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44978 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-44978?: Check whether you run Neutrinolabs Xrdp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap out-of-bounds read exists in xrdp versions 0.10.6 and prior due to improper input validation of the FIPS padding length field. When the security layer is configured as 'negotiate' or 'rdp' and 'crypt_level' is set to 'fips' in xrdp.ini, the server fails to validate padding lengths in incoming PDUs. This leads to a pointer underflow and a subsequent negative length calculation during processing. An unauthenticated remote attacker can trigger this by sending a crafted FIPS-protected PDU, resulting in a process crash. Because xrdp forks a new process per connection, the impact is limited to a denial of service for the specific session rather than the entire daemon. The issue is fixed in version 0.10.6.1.

Affected products

neutrinolabs xrdp <= 0.10.6

Timeline

2026-07-01: advisory: GitHub Security Advisory published
2026-07-06: patched: Version 0.10.6.1 released
2026-07-20: disclosed: CVE-2026-44978 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.