CVE-2026-55626
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
xrdp versions up to 0.10.6 launch Xvnc over UNIX sockets with insufficient authentication. A local authenticated attacker can bypass session isolation and unauthorizedly view or control other users' sessions. Only the Xvnc backend over UNIX sockets is affected.
Risk Assessment
The organization risks breach of user session isolation on the same system, potentially leading to unauthorized access to sensitive data or session hijacking.
Recommendation
Upgrade xrdp to version 0.10.6.1 or later, which includes the fix.
Other vulnerabilities in xrdp
See all- CVE-2017-16927High
The scp_v0s_accept function in the session manager of xrdp up to version 0.9.4 uses an untrusted integer as a write length, which can lead to buffer overflow and application crash.
- CVE-2017-6967High
xrdp version 0.9.1 calls the PAM function auth_start_session() in an incorrect location, leading to improper initialization of PAM session modules. This may result in incorrect configurations or elevation of privileges.
- CVE-2026-41252Critical
xrdp versions up to 0.10.6 have a missing bounds check in vnc-any mode, leading to a heap-based buffer overflow when handling RFB color map messages from a VNC server. A malicious VNC server can send crafted messages with out-of-range values, causing an out-of-bounds write on the heap.
- CVE-2013-1430Critical
An issue was discovered in xrdp before 0.9.1, where a file ~/.vnc/sesman_${username}_passwd is created upon successful RDP login. Its content is the user's cleartext password, DES encrypted with a known key.
- CVE-2026-55639Medium
xrdp versions 0.10.6 and earlier contain a vulnerability in parsing client security data. An unauthenticated attacker can send a crafted RDP packet, causing out-of-bounds memory read.
- CVE-2026-55645Medium
xrdp versions up to 0.10.6 have a vulnerability in processing Client Control PDUs. Insufficient length validation before reading data can lead to out-of-bounds memory reads by a remote, unauthenticated attacker. This results in a crash of the xrdp process (Denial of Service), but not the entire service, as xrdp forks a new process per connection by default.
- CVE-2026-55238Medium
xrdp versions up to 0.10.6 contain an out-of-bounds read vulnerability during processing of RDP Confirm Active PDU. Insufficient length validation of capability sets allows an unauthenticated remote attacker to send a crafted RDP packet, potentially causing a process crash and denial of service (DoS).
- CVE-2026-54538High
Vulnerability in xrdp due to improper validation of the totalLength field in the RDP protocol header. An unauthenticated attacker can send a crafted packet, causing an infinite CPU loop and resource exhaustion.
- CVE-2026-44978Medium
xrdp versions up to 0.10.6 contain a heap out-of-bounds read vulnerability in FIPS-specific receive paths. The vulnerability does not affect the default configuration and requires security_layer=negotiate or security_layer=rdp and crypt_level=fips in xrdp.ini. An unauthenticated remote attacker can send a crafted FIPS-protected PDU, causing a process crash and denial of service (DoS).
- CVE-2026-44178High
Heap-based buffer overflow in the virtual channel forwarding mechanism in xrdp versions 0.10.6 and earlier. An authenticated remote attacker can send a crafted virtual channel message, causing heap memory corruption.
Original NVD description (English source)
xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this vulnerability to bypass intended session isolation, allowing them to unauthorizedly view or control the active desktop sessions of other users on the same system. Users using other backends, such as xorgxrdp or Xvnc over TCP sockets, are not affected. This issue has been fixed in version 0.10.6.1.