CVE-2026-44178

NameCVE-2026-44178
Descriptionxrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer without adequate bounds checking on the incoming payload. An authenticated remote attacker can exploit this flaw by sending a specially crafted virtual channel message that exceeds the buffer capacity, leading to heap memory corruption. This may result in a denial of service or the execution of arbitrary code with the privileges of the xrdp process. This issue has been fixed in version 0.10.6.1.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
xrdp (PTS)bullseye0.9.21.1-1~deb11u1vulnerable
bullseye (security)0.9.21.1-1~deb11u3vulnerable
bookworm, bookworm (security)0.9.21.1-1+deb12u2vulnerable
trixie (security), trixie0.10.1-3.1+deb13u1vulnerable
sid0.10.6.1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
xrdpsourceexperimental0.10.6.1-1
xrdpsource(unstable)0.10.6.1-2

Notes

https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-hh7r-2rmq-q4g4

Search for package or bug name: Reporting problems