Executive brief
xrdp is an open-source tool that allows users to remotely control a computer's desktop over a network. A security flaw has been found where the software does not properly check the size of incoming connection requests. This could allow an unauthorized person to peek at small amounts of the computer's memory, potentially revealing sensitive information that could be used in further attacks.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in xrdp versions 0.10.6 and prior during the parsing of Client Security Data within the Client MCS Connect Initial PDU. The flaw occurs because the parser fails to perform sufficient length validation on incoming data blocks during the initial capability and security negotiation phase. A remote, unauthenticated attacker can exploit this by sending a specially crafted RDP packet. This missing bounds check allows the process to read a small number of bytes beyond the intended buffer, potentially leaking sensitive process memory. The issue is addressed in version 0.10.6.1.
Affected products
- neutrinolabs xrdp <= 0.10.6
Timeline
- 2026-07-02: advisory: GitHub Security Advisory published by maintainers
- 2026-07-06: patched: Version 0.10.6.1 released
- 2026-07-20: disclosed: CVE published to NVD