CVE-2025-68670: xrdp RDP Server Stack-Based Buffer Overflow
xrdp versions before 0.10.5 contain an unauthenticated stack-based buffer overflow in the RDP connection sequence, which the record attributes to improper bounds checking of user domain data. NVD scores the issue 9.8 under CVSS 3.1, and the record states that upgrading to 0.10.5 provides the patch. No confirmed exploitation appears in the sources consulted, and the issue is not listed in CISA KEV.
Overview
xrdp is an open source RDP server. This record describes an unauthenticated stack-based buffer overflow in versions before 0.10.5, attributed to improper bounds checking when user domain information is processed during the connection sequence. The weakness is classified as CWE-787 (Out-of-bounds Write).
Impact
- The record states that remote attackers could potentially execute arbitrary code on the target system.
- The description notes that overwriting the stack buffer and the return address could theoretically redirect execution flow.
- If the executable was built with stack canary protection, the record says a second vulnerability would be needed to leak the canary value, which lessens the impact.
- NVD lists a CVSS 3.1 base score of 9.8 (Critical); the GitHub record lists 9.1 under CVSS 3.1.
Affected products and versions
- Neutrinolabs xrdp before 0.10.5, as listed in the record.
- The record also lists Debian Debian Linux version 11.0 as affected. The sources consulted do not explain this association beyond the listing.
Exploitation status
The CISA KEV entry in this record is marked as not listed. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Upgrade xrdp to version 0.10.5, which the record identifies as the version containing the patch. The fix commit and the release notes are referenced.
- Do not rely on stack canary protection as a compensating control on production systems, as the record advises.
- Inference: limit exposure of RDP services to trusted networks and place remote access behind controlled gateways until patching is complete.
Detection guidance
- Inventory hosts running xrdp and record installed versions, including Debian systems that may carry the xrdp package.
- Monitor for unexpected crashes or restarts of the xrdp service, which can accompany memory corruption issues.
- Review RDP connection logs for connections from unexpected or untrusted sources.
Limitations of the available information
- The record does not provide a detailed affected version range for Debian Linux 11.0 or explain how it relates to xrdp.
- EPSS and SSVC data are not present in the record.
- The content of the Debian LTS announcement referenced in the record was not reviewed for this analysis.
- Whether the theoretical control-flow redirection is practical in a given deployment is not established by the available data.
Frequently asked questions
What is the vulnerability in CVE-2025-68670?
It is an unauthenticated stack-based buffer overflow in xrdp versions before 0.10.5, linked in the record to improper bounds checking of user domain information during the connection sequence.
What version fixes CVE-2025-68670?
The record states that upgrading to version 0.10.5 provides the patch, and it references a fix commit and release notes.
Is CVE-2025-68670 known to be exploited in the wild?
The record marks the issue as not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.