Executive brief
xrdp is an open-source tool that allows users to remotely access and control a computer's desktop. A security flaw in how it handles initial connection requests could allow an unauthenticated attacker to crash the specific process handling their connection. While this typically only affects that individual session rather than the entire server, it represents a stability risk that could be used to disrupt remote access services.
Technical details
A buffer over-read vulnerability (CWE-126) exists in xrdp versions 0.10.6 and earlier within the RDP Confirm Active PDU processing logic. During the capability negotiation phase, the parser fails to perform adequate length validation on specific capability sets. A remote, unauthenticated attacker can exploit this by sending a specially crafted RDP packet with malformed capability data. This lack of bounds checking leads to out-of-bounds memory reads, causing the xrdp process to crash. Because xrdp typically forks a new process for each connection, the impact is generally limited to a Denial of Service (DoS) for the specific session rather than the entire daemon. The issue is resolved in version 0.10.6.1.
Affected products
- neutrinolabs xrdp <= 0.10.6
Timeline
- 2026-07-01: advisory: GitHub Security Advisory published
- 2026-07-06: patched: Version 0.10.6.1 released
- 2026-07-20: disclosed: CVE published to NVD