Vulnerabilidades do Neutrinolabs Xrdp

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Neutrinolabs Xrdp: 9 registro(s), com versões afetadas e correções.
cpe:2.3:a:neutrinolabs:xrdp

CVE-2026-35512 Alta · 8.8 CWE-122 17/04/2026

xrdp: Heap buffer overflow in EGFX channel

xrdp is an open source RDP server. Versions through 0.10.5 have a heap-based buffer overflow in the EGFX (graphics dynamic virtual channel) implementation due to insufficient validation of client-controlled size parameters, allowing an out-of-bounds write via crafted PDUs. Pre-authentication exploitation can crash the process, while post-authentication exploitation may achieve remote code execution. This issue has been fixed in version 0.10.6. If users are unable to immediately update, they should run xrdp as a non-privileged user (default since 0.10.2) to limit the impact of successful exploitation.

CVE-2026-33689 Crítica · 9.1 CWE-125 17/04/2026

xrdp: Pre-authentication out-of-bounds reads in channel parsers

xrdp is an open source RDP server. Versions through 0.10.5 have an out-of-bounds read vulnerability in the pre-authentication RDP message parsing logic. A remote, unauthenticated attacker can trigger this flaw by sending a specially crafted sequence of packets during the initial connection phase. This vulnerability results from insufficient validation of input buffer lengths before processing dynamic channel communication. Successful exploitation can lead to a denial-of-service (DoS) condition via a process crash or potential disclosure of sensitive information from the service's memory space. This issue has been fixed in version 0.10.6.

CVE-2026-33145 Média · 6.3 CWE-78 17/04/2026

xrdp: Authenticated RCE via unsanitized AlternateShell execution in xrdp-sesman

xrdp is an open source RDP server. Versions through 0.10.5 allow an authenticated remote user to execute arbitrary commands on the server due to unsafe handling of the AlternateShell parameter in xrdp-sesman. When the AllowAlternateShell setting is enabled (which is the default when not explicitly configured), xrdp accepts a client-supplied AlternateShell value and executes it via /bin/sh -c during session initialization. This results in shell-interpreted execution of unsanitized, user-controlled input. This behavior effectively provides a scriptable remote command execution primitive over RDP within the security context of the authenticated user, occurring prior to normal window manager startup. This can bypass expected session initialization flows and operational assumptions that restrict execution to interactive desktop environments. This issue has been fixed in version 0.10.6.

CVE-2026-33516 Crítica · 9.1 CWE-125 17/04/2026

xrdp: Pre-authentication out-of-bounds reads in RDP capability and channel parsers

xrdp is an open source RDP server. Versions through 0.10.5 contain an out-of-bounds read vulnerability during the RDP capability exchange phase. The issue occurs when memory is accessed before validating the remaining buffer length. A remote, unauthenticated attacker can trigger this vulnerability by sending a specially crafted Confirm Active PDU. Successful exploitation could lead to a denial of service (process crash) or potential disclosure of sensitive information from the process memory. This issue has been fixed in version 0.10.6.

CVE-2026-32624 Média · 6.5 CWE-122 17/04/2026

xrdp: Heap buffer overflow in xrdp_sec_process_logon_info() via incorrect g_strncat length calculation

xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow vulnerability in its logon processing. In environments where domain_user_separator is configured in xrdp.ini, an unauthenticated remote attacker can send a crafted, excessively long username and domain name to overflow the internal buffer. This can corrupt adjacent memory regions, potentially leading to a Denial of Service (DoS) or unexpected behavior. The domain_name_separator directive is commented out by default, systems are not affected by this vulnerability unless it is intentionally configured. This issue has been fixed in version 0.10.6.

CVE-2026-32623 Alta · 8.1 CWE-122 17/04/2026

xrdp: Heap buffer overflow in NeutrinoRDP channel reassembly

xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow vulnerability in the NeutrinoRDP module. When proxying RDP sessions from xrdp to another server, the module fails to properly validate the size of reassembled fragmented virtual channel data against its allocated memory buffer. A malicious downstream RDP server (or an attacker capable of performing a Man-in-the-Middle attack) could exploit this flaw to cause memory corruption, potentially leading to a Denial of Service (DoS) or Remote Code Execution (RCE). The NeutrinoRDP module is not built by default. This vulnerability only affects environments where the module has been explicitly compiled and enabled. Users can verify if the module is built by checking for --enable-neutrinordp in the output of the xrdp -v command. This issue has been fixed in version 0.10.6.

CVE-2026-32107 Alta · 8.8 CWE-273 17/04/2026

xrdp: Fail-open privilege drop in sesexec — child processes may execute as root if setuid fails

xrdp is an open source RDP server. In versions through 0.10.5, the session execution component did not properly handle an error during the privilege drop process. This improper privilege management could allow an authenticated local attacker to escalate privileges to root and execute arbitrary code on the system. An additional exploit would be needed to facilitate this. This issue has been fixed in version 0.10.6.

CVE-2026-32105 Alta · 7.7 CWE-354 17/04/2026

xrdp: RDP MAC signature (dataSignature) never verified on receive — integrity bypass in non-TLS mode

xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement verification for the Message Authentication Code (MAC) signature of encrypted RDP packets when using the "Classic RDP Security" layer. While the sender correctly generates signatures, the receiving logic lacks the necessary implementation to validate the 8-byte integrity signature, causing it to be silently ignored. An unauthenticated attacker with man-in-the-middle (MITM) capabilities can exploit this missing check to modify encrypted traffic in transit without detection. It does not affect connections where the TLS security layer is enforced. This issue has been fixed in version 0.10.6. If users are unable to immediately upgrade, they should configure xrdp.ini to enforce TLS security (security_layer=tls) to ensure end-to-end integrity.

CVE-2025-68670 Crítica · 9.8 CWE-787 27/01/2026

Estouro de buffer baseado em pilha no servidor RDP xrdp (CVE-2025-68670)

xrdp é um servidor RDP de código aberto. O xrdp anterior à v0.10.5 contém uma vulnerabilidade de estouro de buffer baseado em pilha (stack-based buffer overflow) não autenticada. O problema decorre de verificação inadequada de limites ao processar informações de domínio do usuário durante a sequência de conexão. Se explorada, a vulnerabilidade poderia permitir que atacantes remotos executassem código arbitrário no sistema alvo. A vulnerabilidade permite que um atacante sobrescreva o buffer na pilha e o endereço de retorno, o que, teoricamente, poderia ser usado para redirecionar o fluxo de execução. O impacto desta vulnerabilidade é reduzido se uma flag do compilador tiver sido usada para compilar o executável do xrdp com proteção por canário de pilha (stack canary). Nesse caso, uma segunda vulnerabilidade precisaria ser usada para vazar o valor do canário de pilha. Atualize para a versão 0.10.5 para receber a correção. Além disso, não dependa da proteção por canário de pilha em sistemas de produção.