CVE-2026-55645: neutrinolabs xrdp out-of-bounds read in Client Control PDU processing

CVE-2026-55645 · Severity: medium · CVSS 6.5 · Published 2026-07-20

xrdp is an open-source tool that allows users to remotely access and control a computer's desktop. A security flaw in how it handles initial connection requests could allow an unauthenticated attacker to crash the specific session process or potentially view small amounts of restricted memory. While this may disrupt an individual user's connection, the main service typically remains running because it creates a separate process for every new connection.

Technologies: Neutrinolabs Xrdp. Vendors: Neutrinolabs.

Quick answers

Is CVE-2026-55645 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55645 being exploited in the wild.
How severe is CVE-2026-55645?
Medium severity, with a CVSS score of 6.5, published 20 July 2026.
Which products and versions are affected?
Neutrinolabs Xrdp <= 0.10.6.
Is there a fix for CVE-2026-55645?
A patch was published on 2026-07-07: Version 0.10.6.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55645 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-55645?
Check whether you run Neutrinolabs Xrdp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read vulnerability (CWE-125) exists in xrdp versions 0.10.6 and prior within the parser responsible for Client Control Protocol Data Units (PDUs). The root cause is insufficient length validation of incoming network streams during the RDP connection sequence. A remote, unauthenticated attacker can exploit this by sending a specially crafted, truncated PDU, leading the process to read memory beyond the allocated buffer. This typically results in a segmentation fault (Denial of Service) for the specific forked connection process, though the impact on the main daemon is limited due to xrdp's process-per-connection architecture. The issue is fixed in version 0.10.6.1.

Affected products

  • neutrinolabs xrdp <= 0.10.6

Timeline

  • 2026-07-02: advisory: GitHub Security Advisory published
  • 2026-07-07: patched: Version 0.10.6.1 released
  • 2026-07-20: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.