neutrinolabs xrdp up to 0.10.5 FIPS-specific receive paths xrdp.ini input validation

Summaryinfo

A vulnerability was found in neutrinolabs xrdp up to 0.10.5. It has been rated as critical. This issue affects some unknown processing of the file xrdp.ini of the component FIPS-specific receive paths. The manipulation leads to input validation. This vulnerability is documented as CVE-2026-44978. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in neutrinolabs xrdp up to 0.10.5. It has been rated as critical. This issue affects an unknown function of the file xrdp.ini of the component FIPS-specific receive paths. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulnerability does not affect the default configuration of xrdp. The vulnerability is only exploitable when the security layer is set to security_layer=negotiate or security_layer=rdp, and the crypto level is changed to crypt_level=fips in xrdp.ini. In this specific non-default mode, the server fails to validate the FIPS padding length field, leading to a pointer underflow and a subsequent negative length calculation. An unauthenticated remote attacker can exploit this by sending a crafted FIPS-protected PDU, causing a heap out-of-bounds read that results in a process crash and denial of service (DoS). However, since xrdp forks a new process for each connection by default, an out-of-bounds read causing a process crash is unlikely to bring down the entire xrdp service. This issue has been fixed in version 0.10.6.1.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-44978 since 05/08/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

By approaching the search of inurl:xrdp.ini it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 0.10.6.1 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• neutrinolabs

Name

• xrdp

Version

• 0.10.0
• 0.10.1
• 0.10.2
• 0.10.3
• 0.10.4
• 0.10.5

Website

• Product: https://github.com/neutrinolabs/xrdp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion