Hi,
The following vulnerabilities were published for xrdp.
CVE-2026-32105[0]:
| xrdp is an open source RDP server. In versions through 0.10.5, xrdp
| does not implement verification for the Message Authentication Code
| (MAC) signature of encrypted RDP packets when using the "Classic RDP
| Security" layer. While the sender correctly generates signatures,
| the receiving logic lacks the necessary implementation to validate
| the 8-byte integrity signature, causing it to be silently ignored.
| An unauthenticated attacker with man-in-the-middle (MITM)
| capabilities can exploit this missing check to modify encrypted
| traffic in transit without detection. It does not affect connections
| where the TLS security layer is enforced. This issue has been fixed
| in version 0.10.6. If users are unable to immediately upgrade, they
| should configure xrdp.ini to enforce TLS security
| (security_layer=tls) to ensure end-to-end integrity.
CVE-2026-32107[1]:
| xrdp is an open source RDP server. In versions through 0.10.5, the
| session execution component did not properly handle an error during
| the privilege drop process. This improper privilege management could
| allow an authenticated local attacker to escalate privileges to root
| and execute arbitrary code on the system. An additional exploit
| would be needed to facilitate this. This issue has been fixed in
| version 0.10.6.
CVE-2026-32623[2]:
| xrdp is an open source RDP server. Versions through 0.10.5 contain a
| heap-based buffer overflow vulnerability in the NeutrinoRDP module.
| When proxying RDP sessions from xrdp to another server, the module
| fails to properly validate the size of reassembled fragmented
| virtual channel data against its allocated memory buffer. A
| malicious downstream RDP server (or an attacker capable of
| performing a Man-in-the-Middle attack) could exploit this flaw to
| cause memory corruption, potentially leading to a Denial of Service
| (DoS) or Remote Code Execution (RCE). The NeutrinoRDP module is not
| built by default. This vulnerability only affects environments where
| the module has been explicitly compiled and enabled. Users can
| verify if the module is built by checking for --enable-neutrinordp
| in the output of the xrdp -v command. This issue has been fixed in
| version 0.10.6.
CVE-2026-32624[3]:
| xrdp is an open source RDP server. Versions through 0.10.5 contain a
| heap-based buffer overflow vulnerability in its logon processing. In
| environments where domain_user_separator is configured in xrdp.ini,
| an unauthenticated remote attacker can send a crafted, excessively
| long username and domain name to overflow the internal buffer. This
| can corrupt adjacent memory regions, potentially leading to a Denial
| of Service (DoS) or unexpected behavior. The domain_name_separator
| directive is commented out by default, systems are not affected by
| this vulnerability unless it is intentionally configured. This issue
| has been fixed in version 0.10.6.
CVE-2026-33145[4]:
| xrdp is an open source RDP server. Versions through 0.10.5 allow an
| authenticated remote user to execute arbitrary commands on the
| server due to unsafe handling of the AlternateShell parameter in
| xrdp-sesman. When the AllowAlternateShell setting is enabled (which
| is the default when not explicitly configured), xrdp accepts a
| client-supplied AlternateShell value and executes it via /bin/sh -c
| during session initialization. This results in shell-interpreted
| execution of unsanitized, user-controlled input. This behavior
| effectively provides a scriptable remote command execution primitive
| over RDP within the security context of the authenticated user,
| occurring prior to normal window manager startup. This can bypass
| expected session initialization flows and operational assumptions
| that restrict execution to interactive desktop environments. This
| issue has been fixed in version 0.10.6.
CVE-2026-33516[5]:
| xrdp is an open source RDP server. Versions through 0.10.5 contain
| an out-of-bounds read vulnerability during the RDP capability
| exchange phase. The issue occurs when memory is accessed before
| validating the remaining buffer length. A remote, unauthenticated
| attacker can trigger this vulnerability by sending a specially
| crafted Confirm Active PDU. Successful exploitation could lead to a
| denial of service (process crash) or potential disclosure of
| sensitive information from the process memory. This issue has been
| fixed in version 0.10.6.
CVE-2026-33689[6]:
| xrdp is an open source RDP server. Versions through 0.10.5 have an
| out-of-bounds read vulnerability in the pre-authentication RDP
| message parsing logic. A remote, unauthenticated attacker can
| trigger this flaw by sending a specially crafted sequence of packets
| during the initial connection phase. This vulnerability results from
| insufficient validation of input buffer lengths before processing
| dynamic channel communication. Successful exploitation can lead to a
| denial-of-service (DoS) condition via a process crash or potential
| disclosure of sensitive information from the service's memory space.
| This issue has been fixed in version 0.10.6.
CVE-2026-35512[7]:
| xrdp is an open source RDP server. Versions through 0.10.5 have a
| heap-based buffer overflow in the EGFX (graphics dynamic virtual
| channel) implementation due to insufficient validation of client-
| controlled size parameters, allowing an out-of-bounds write via
| crafted PDUs. Pre-authentication exploitation can crash the process,
| while post-authentication exploitation may achieve remote code
| execution. This issue has been fixed in version 0.10.6. If users are
| unable to immediately update, they should run xrdp as a non-
| privileged user (default since 0.10.2) to limit the impact of
| successful exploitation.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-32105
https://www.cve.org/CVERecord?id=CVE-2026-32105
[1] https://security-tracker.debian.org/tracker/CVE-2026-32107
https://www.cve.org/CVERecord?id=CVE-2026-32107
[2] https://security-tracker.debian.org/tracker/CVE-2026-32623
https://www.cve.org/CVERecord?id=CVE-2026-32623
[3] https://security-tracker.debian.org/tracker/CVE-2026-32624
https://www.cve.org/CVERecord?id=CVE-2026-32624
[4] https://security-tracker.debian.org/tracker/CVE-2026-33145
https://www.cve.org/CVERecord?id=CVE-2026-33145
[5] https://security-tracker.debian.org/tracker/CVE-2026-33516
https://www.cve.org/CVERecord?id=CVE-2026-33516
[6] https://security-tracker.debian.org/tracker/CVE-2026-33689
https://www.cve.org/CVERecord?id=CVE-2026-33689
[7] https://security-tracker.debian.org/tracker/CVE-2026-35512
https://www.cve.org/CVERecord?id=CVE-2026-35512
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore