Heap-based Buffer Overflow in xrdp RDP Server by Neutrinolabs
CVE-2026-35512

8.7HIGH

Key Information:

Vendor

Neutrinolabs

Status
Xrdp
Vendor
CVE Published:
17 April 2026

What is CVE-2026-35512?

A heap-based buffer overflow vulnerability exists in the xrdp RDP server versions up to 0.10.5 due to inadequate validation of client-controlled size parameters within the EGFX implementation. This flaw can be exploited via crafted Protocol Data Units (PDUs), leading to an out-of-bounds write. Pre-authentication exploitation may result in a process crash, while post-authentication exploitation could allow remote code execution. Users are advised to upgrade to version 0.10.6 to mitigate this risk. Alternatively, running xrdp as a non-privileged user can help limit the potential impact of this vulnerability.

Affected Version(s)

xrdp < 0.10.6

References

https://github.com/neutrinolabs/xrdp/security/advisories/...
x_refsource_CONFIRM
https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.