Heap-Based Buffer Overflow in xrdp RDP Server by Neutrinolabs

CVE-2026-32624

What is CVE-2026-32624?

The xrdp RDP server, an open source implementation, has a vulnerability in its logon processing due to a heap-based buffer overflow found in versions up to 0.10.5. When the domain_user_separator directive is set in the xrdp.ini configuration, an unauthenticated remote attacker could exploit this vulnerability by sending an excessively long username and domain name. This overflow can corrupt adjacent memory, potentially resulting in a Denial of Service or unpredictable behavior on the system. It is important to note that this issue only affects systems where the domain_name_separator is explicitly configured. The vulnerability has been addressed in version 0.10.6.

References