CVE-2026-44178

תיאור (מקור, אנגלית)

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer without adequate bounds checking on the incoming payload. An authenticated remote attacker can exploit this flaw by sending a specially crafted virtual channel message that exceeds the buffer capacity, leading to heap memory corruption. This may result in a denial of service or the execution of arbitrary code with the privileges of the xrdp process. This issue has been fixed in version 0.10.6.1.

מדדים

CVSS 3.1

8.8 (HIGH) מקור הציון: CNA CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — סבירות ניצול

1% (אחוזון 000) נכון ל-2/8/2026

CWE

CWE-122

מוצרים מושפעים

neutrinolabs: xrdp

קישורים

• https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-hh7r-2rmq-q4g4 Vendor Advisory
• https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1 Release Notes