Executive brief
xrdp is an open-source tool that allows users to remotely access Linux desktops using the Remote Desktop Protocol (RDP). A flaw in how the software handles incoming connection requests allows an unauthenticated attacker to trigger an infinite loop, causing the server to consume 100% of its CPU resources. This can crash the remote desktop service for all users and potentially slow down or freeze the entire host system.
Technical details
A vulnerability classified as CWE-835 (Loop with Unreachable Exit Condition) exists in xrdp versions 0.10.6 and prior. The root cause is a failure to validate the 'totalLength' field within the RDP protocol control header during packet reception. By sending a specially crafted packet, an unauthenticated remote attacker can prevent the internal data pointer from advancing. This bypasses deadlock prevention mechanisms for specific protocol data units, resulting in an infinite, CPU-bound loop. This leads to service unavailability and potential system-wide resource exhaustion. The issue is resolved in version 0.10.6.1.
Affected products
- neutrinolabs xrdp <= 0.10.6
Timeline
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-06: patched: Version 0.10.6.1 released
- 2026-07-20: disclosed: NVD publication date