Out-of-Bounds Read Vulnerability in xrdp RDP Server

CVE-2026-33689

What is CVE-2026-33689?

The xrdp RDP server, an open-source implementation allowing remote desktop protocol connectivity, suffers from an out-of-bounds read vulnerability present in versions up to 0.10.5. This security flaw allows a remote, unauthenticated attacker to exploit the pre-authentication RDP message parsing logic. By sending specially crafted packets during the initial connection phase, the attacker can manipulate the input buffer lengths, which may lead to a denial-of-service condition through process crashes. Furthermore, there is a risk of sensitive information exposure from the service's memory space. The issue has been resolved in version 0.10.6.

References