Executive brief
xrdp is an open-source tool that allows users to remotely access and control a computer's desktop. A security flaw in how it handles initial connection requests could allow an unauthenticated attacker to crash the specific session process or potentially view small amounts of restricted memory. While this may disrupt an individual user's connection, the main service typically remains running because it creates a separate process for every new connection.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in xrdp versions 0.10.6 and prior within the parser responsible for Client Control Protocol Data Units (PDUs). The root cause is insufficient length validation of incoming network streams during the RDP connection sequence. A remote, unauthenticated attacker can exploit this by sending a specially crafted, truncated PDU, leading the process to read memory beyond the allocated buffer. This typically results in a segmentation fault (Denial of Service) for the specific forked connection process, though the impact on the main daemon is limited due to xrdp's process-per-connection architecture. The issue is fixed in version 0.10.6.1.
Affected products
- neutrinolabs xrdp <= 0.10.6
Timeline
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-07: patched: Version 0.10.6.1 released
- 2026-07-20: disclosed: CVE published to NVD