CVE-2026-55645
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
xrdp versions up to 0.10.6 have a vulnerability in processing Client Control PDUs. Insufficient length validation before reading data can lead to out-of-bounds memory reads by a remote, unauthenticated attacker. This results in a crash of the xrdp process (Denial of Service), but not the entire service, as xrdp forks a new process per connection by default.
Risk Assessment
A remote attacker can crash a single xrdp process, disrupting an RDP session. In multi-session environments, the risk of full service unavailability is low.
Recommendation
Upgrade xrdp to version 0.10.6.1 or later immediately, which contains the fix.
Other vulnerabilities in xrdp
See all- CVE-2017-16927High
The scp_v0s_accept function in the session manager of xrdp up to version 0.9.4 uses an untrusted integer as a write length, which can lead to buffer overflow and application crash.
- CVE-2017-6967High
xrdp version 0.9.1 calls the PAM function auth_start_session() in an incorrect location, leading to improper initialization of PAM session modules. This may result in incorrect configurations or elevation of privileges.
- CVE-2026-41252Critical
xrdp versions up to 0.10.6 have a missing bounds check in vnc-any mode, leading to a heap-based buffer overflow when handling RFB color map messages from a VNC server. A malicious VNC server can send crafted messages with out-of-range values, causing an out-of-bounds write on the heap.
- CVE-2013-1430Critical
An issue was discovered in xrdp before 0.9.1, where a file ~/.vnc/sesman_${username}_passwd is created upon successful RDP login. Its content is the user's cleartext password, DES encrypted with a known key.
- CVE-2026-55639Medium
xrdp versions 0.10.6 and earlier contain a vulnerability in parsing client security data. An unauthenticated attacker can send a crafted RDP packet, causing out-of-bounds memory read.
- CVE-2026-55626High
xrdp versions up to 0.10.6 launch Xvnc over UNIX sockets with insufficient authentication. A local authenticated attacker can bypass session isolation and unauthorizedly view or control other users' sessions. Only the Xvnc backend over UNIX sockets is affected.
- CVE-2026-55238Medium
xrdp versions up to 0.10.6 contain an out-of-bounds read vulnerability during processing of RDP Confirm Active PDU. Insufficient length validation of capability sets allows an unauthenticated remote attacker to send a crafted RDP packet, potentially causing a process crash and denial of service (DoS).
- CVE-2026-54538High
Vulnerability in xrdp due to improper validation of the totalLength field in the RDP protocol header. An unauthenticated attacker can send a crafted packet, causing an infinite CPU loop and resource exhaustion.
- CVE-2026-44978Medium
xrdp versions up to 0.10.6 contain a heap out-of-bounds read vulnerability in FIPS-specific receive paths. The vulnerability does not affect the default configuration and requires security_layer=negotiate or security_layer=rdp and crypt_level=fips in xrdp.ini. An unauthenticated remote attacker can send a crafted FIPS-protected PDU, causing a process crash and denial of service (DoS).
- CVE-2026-44178High
Heap-based buffer overflow in the virtual channel forwarding mechanism in xrdp versions 0.10.6 and earlier. An authenticated remote attacker can send a crafted virtual channel message, causing heap memory corruption.
Original NVD description (English source)
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connection sequence, the parser does not perform sufficient length validation before reading specific data fields from the network stream. A remote, unauthenticated attacker could potentially exploit this flaw by sending a specially crafted, truncated Client Control PDU. Due to missing bounds checks, the xrdp process may perform out-of-bounds memory reads, which can result in the termination of the service (Denial of Service). However, since xrdp forks a new process for each connection by default, an out-of-bounds read causing a process crash is unlikely to bring down the entire xrdp service.This issue has been fixed in version 0.10.6.1.