Heap-Based Buffer Overflow in xrdp Open Source RDP Server
CVE-2026-41252

9.8CRITICAL

Key Information:

Vendor

Neutrinolabs

Status
Xrdp
Vendor
CVE Published:
20 July 2026

What is CVE-2026-41252?

The xrdp open source RDP server is affected by a heap-based buffer overflow vulnerability due to insufficient bounds checking. This issue manifests when xrdp operates in vnc-any mode, specifically during the processing of RFB protocol color map messages from a VNC server. Unsanitized incoming color indices can allow a malicious VNC server to send crafted messages with invalid values, leading to out-of-bounds writes on the heap. Consequently, this memory corruption could enable denial of service or potentially remote code execution before user authentication. Users are recommended to upgrade to version 0.10.6.1 or later to mitigate any risks associated with this vulnerability.

Affected Version(s)

xrdp < 0.10.6.1

References

https://github.com/neutrinolabs/xrdp/security/advisories/...
x_refsource_CONFIRM
https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.