CVE-2026-44178

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer without adequate bounds checking on the incoming payload. An authenticated remote attacker can exploit this flaw by sending a specially crafted virtual channel message that exceeds the buffer capacity, leading to heap memory corruption. This may result in a denial of service or the execution of arbitrary code with the privileges of the xrdp process. This issue has been fixed in version 0.10.6.1.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1	Release Notes
https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-hh7r-2rmq-q4g4	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:neutrinolabs:xrdp:*:*:*:*:*:*:*:*

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) xrdp es un servidor RDP de código abierto. Las versiones 0.10.6 y anteriores contienen una vulnerabilidad de desbordamiento de búfer basado en montículo dentro del mecanismo de reenvío de canal virtual. Al reenviar datos de un cliente remoto al servidor de canal interno, el proceso xrdp utiliza un búfer de tamaño fijo sin una comprobación de límites adecuada en la carga útil entrante. Un atacante remoto autenticado puede explotar esta falla enviando un mensaje de canal virtual especialmente diseñado que excede la capacidad del búfer, lo que lleva a la corrupción de memoria del montículo. Esto puede resultar en una denegación de servicio o la ejecución de código arbitrario con los privilegios del proceso xrdp. Este problema ha sido solucionado en la versión 0.10.6.1.

Information

Published : 2026-07-20 17:17

Updated : 2026-10-24 20:10

NVD link : CVE-2026-44178

Mitre link : CVE-2026-44178

CVE.ORG link : CVE-2026-44178

JSON object : View

Products Affected

neutrinolabs

xrdp

CWE

CWE-122

Heap-based Buffer Overflow

{"id": "CVE-2026-44178", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44178", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-22T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "neutrinolabs", "product": "xrdp", "versions": [{"status": "affected", "version": "< 0.10.6.1"}]}]}], "published": "2026-07-20T17:17:09.060", "references": [{"url": "https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-hh7r-2rmq-q4g4", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-122"}]}], "descriptions": [{"lang": "en", "value": "xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer without adequate bounds checking on the incoming payload. An authenticated remote attacker can exploit this flaw by sending a specially crafted virtual channel message that exceeds the buffer capacity, leading to heap memory corruption. This may result in a denial of service or the execution of arbitrary code with the privileges of the xrdp process. This issue has been fixed in version 0.10.6.1."}, {"lang": "es", "value": "xrdp es un servidor RDP de c\u00f3digo abierto. Las versiones 0.10.6 y anteriores contienen una vulnerabilidad de desbordamiento de b\u00fafer basado en mont\u00edculo dentro del mecanismo de reenv\u00edo de canal virtual. Al reenviar datos de un cliente remoto al servidor de canal interno, el proceso xrdp utiliza un b\u00fafer de tama\u00f1o fijo sin una comprobaci\u00f3n de l\u00edmites adecuada en la carga \u00fatil entrante. Un atacante remoto autenticado puede explotar esta falla enviando un mensaje de canal virtual especialmente dise\u00f1ado que excede la capacidad del b\u00fafer, lo que lleva a la corrupci\u00f3n de memoria del mont\u00edculo. Esto puede resultar en una denegaci\u00f3n de servicio o la ejecuci\u00f3n de c\u00f3digo arbitrario con los privilegios del proceso xrdp. Este problema ha sido solucionado en la versi\u00f3n 0.10.6.1."}], "lastModified": "2026-10-24T20:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:neutrinolabs:xrdp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A994DC5A-6181-45D2-A489-0E409B19A0FE", "versionEndExcluding": "0.10.6.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}