CVE-2026-54538

The scp_v0s_accept function in the session manager of xrdp up to version 0.9.4 uses an untrusted integer as a write length, which can lead to buffer overflow and application crash.

xrdp version 0.9.1 calls the PAM function auth_start_session() in an incorrect location, leading to improper initialization of PAM session modules. This may result in incorrect configurations or elevation of privileges.

xrdp versions up to 0.10.6 have a missing bounds check in vnc-any mode, leading to a heap-based buffer overflow when handling RFB color map messages from a VNC server. A malicious VNC server can send crafted messages with out-of-range values, causing an out-of-bounds write on the heap.

An issue was discovered in xrdp before 0.9.1, where a file ~/.vnc/sesman_${username}_passwd is created upon successful RDP login. Its content is the user's cleartext password, DES encrypted with a known key.

xrdp versions 0.10.6 and earlier contain a vulnerability in parsing client security data. An unauthenticated attacker can send a crafted RDP packet, causing out-of-bounds memory read.

xrdp versions up to 0.10.6 launch Xvnc over UNIX sockets with insufficient authentication. A local authenticated attacker can bypass session isolation and unauthorizedly view or control other users' sessions. Only the Xvnc backend over UNIX sockets is affected.

xrdp versions up to 0.10.6 have a vulnerability in processing Client Control PDUs. Insufficient length validation before reading data can lead to out-of-bounds memory reads by a remote, unauthenticated attacker. This results in a crash of the xrdp process (Denial of Service), but not the entire service, as xrdp forks a new process per connection by default.

xrdp versions up to 0.10.6 contain an out-of-bounds read vulnerability during processing of RDP Confirm Active PDU. Insufficient length validation of capability sets allows an unauthenticated remote attacker to send a crafted RDP packet, potentially causing a process crash and denial of service (DoS).

xrdp versions up to 0.10.6 contain a heap out-of-bounds read vulnerability in FIPS-specific receive paths. The vulnerability does not affect the default configuration and requires security_layer=negotiate or security_layer=rdp and crypt_level=fips in xrdp.ini. An unauthenticated remote attacker can send a crafted FIPS-protected PDU, causing a process crash and denial of service (DoS).

Heap-based buffer overflow in the virtual channel forwarding mechanism in xrdp versions 0.10.6 and earlier. An authenticated remote attacker can send a crafted virtual channel message, causing heap memory corruption.