CVE-2026-44978
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
xrdp versions up to 0.10.6 contain a heap out-of-bounds read vulnerability in FIPS-specific receive paths. The vulnerability does not affect the default configuration and requires security_layer=negotiate or security_layer=rdp and crypt_level=fips in xrdp.ini. An unauthenticated remote attacker can send a crafted FIPS-protected PDU, causing a process crash and denial of service (DoS).
Risk Assessment
The risk is the possibility of remotely crashing the xrdp process, potentially disrupting RDP sessions. However, due to default process forking, the overall service is likely to remain available.
Recommendation
Upgrade xrdp to version 0.10.6.1 or later, which includes a fix for this vulnerability.
Other vulnerabilities in xrdp
See all- CVE-2017-16927High
The scp_v0s_accept function in the session manager of xrdp up to version 0.9.4 uses an untrusted integer as a write length, which can lead to buffer overflow and application crash.
- CVE-2017-6967High
xrdp version 0.9.1 calls the PAM function auth_start_session() in an incorrect location, leading to improper initialization of PAM session modules. This may result in incorrect configurations or elevation of privileges.
- CVE-2026-41252Critical
xrdp versions up to 0.10.6 have a missing bounds check in vnc-any mode, leading to a heap-based buffer overflow when handling RFB color map messages from a VNC server. A malicious VNC server can send crafted messages with out-of-range values, causing an out-of-bounds write on the heap.
- CVE-2013-1430Critical
An issue was discovered in xrdp before 0.9.1, where a file ~/.vnc/sesman_${username}_passwd is created upon successful RDP login. Its content is the user's cleartext password, DES encrypted with a known key.
- CVE-2026-55639Medium
xrdp versions 0.10.6 and earlier contain a vulnerability in parsing client security data. An unauthenticated attacker can send a crafted RDP packet, causing out-of-bounds memory read.
- CVE-2026-55626High
xrdp versions up to 0.10.6 launch Xvnc over UNIX sockets with insufficient authentication. A local authenticated attacker can bypass session isolation and unauthorizedly view or control other users' sessions. Only the Xvnc backend over UNIX sockets is affected.
- CVE-2026-55645Medium
xrdp versions up to 0.10.6 have a vulnerability in processing Client Control PDUs. Insufficient length validation before reading data can lead to out-of-bounds memory reads by a remote, unauthenticated attacker. This results in a crash of the xrdp process (Denial of Service), but not the entire service, as xrdp forks a new process per connection by default.
- CVE-2026-55238Medium
xrdp versions up to 0.10.6 contain an out-of-bounds read vulnerability during processing of RDP Confirm Active PDU. Insufficient length validation of capability sets allows an unauthenticated remote attacker to send a crafted RDP packet, potentially causing a process crash and denial of service (DoS).
- CVE-2026-54538High
Vulnerability in xrdp due to improper validation of the totalLength field in the RDP protocol header. An unauthenticated attacker can send a crafted packet, causing an infinite CPU loop and resource exhaustion.
- CVE-2026-44178High
Heap-based buffer overflow in the virtual channel forwarding mechanism in xrdp versions 0.10.6 and earlier. An authenticated remote attacker can send a crafted virtual channel message, causing heap memory corruption.
Original NVD description (English source)
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulnerability does not affect the default configuration of xrdp. The vulnerability is only exploitable when the security layer is set to security_layer=negotiate or security_layer=rdp, and the crypto level is changed to crypt_level=fips in xrdp.ini. In this specific non-default mode, the server fails to validate the FIPS padding length field, leading to a pointer underflow and a subsequent negative length calculation. An unauthenticated remote attacker can exploit this by sending a crafted FIPS-protected PDU, causing a heap out-of-bounds read that results in a process crash and denial of service (DoS). However, since xrdp forks a new process for each connection by default, an out-of-bounds read causing a process crash is unlikely to bring down the entire xrdp service. This issue has been fixed in version 0.10.6.1.