CVE-2026-55238: neutrinolabs xrdp buffer over-read in RDP Confirm Active PDU

CVE-2026-55238 · Severity: medium · CVSS 5.3 · Published 2026-07-20

xrdp is an open-source tool that allows users to remotely access and control a computer's desktop. A security flaw in how it handles initial connection requests could allow an unauthenticated attacker to crash the specific process handling their connection. While this typically only affects that individual session rather than the entire server, it represents a stability risk that could be used to disrupt remote access services.

Technologies: Neutrinolabs Xrdp. Vendors: Neutrinolabs.

Quick answers

Is CVE-2026-55238 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55238 being exploited in the wild.
How severe is CVE-2026-55238?
Medium severity, with a CVSS score of 5.3, published 20 July 2026.
Which products and versions are affected?
Neutrinolabs Xrdp <= 0.10.6.
Is there a fix for CVE-2026-55238?
A patch was published on 2026-07-06: Version 0.10.6.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55238 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-55238?
Check whether you run Neutrinolabs Xrdp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A buffer over-read vulnerability (CWE-126) exists in xrdp versions 0.10.6 and earlier within the RDP Confirm Active PDU processing logic. During the capability negotiation phase, the parser fails to perform adequate length validation on specific capability sets. A remote, unauthenticated attacker can exploit this by sending a specially crafted RDP packet with malformed capability data. This lack of bounds checking leads to out-of-bounds memory reads, causing the xrdp process to crash. Because xrdp typically forks a new process for each connection, the impact is generally limited to a Denial of Service (DoS) for the specific session rather than the entire daemon. The issue is resolved in version 0.10.6.1.

Affected products

  • neutrinolabs xrdp <= 0.10.6

Timeline

  • 2026-07-01: advisory: GitHub Security Advisory published
  • 2026-07-06: patched: Version 0.10.6.1 released
  • 2026-07-20: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.