neutrinolabs xrdp up to 0.10.6 PDU memory corruption

Summaryinfo

A vulnerability, which was classified as problematic, was found in neutrinolabs xrdp up to 0.10.6. Impacted is an unknown function of the component PDU. Executing a manipulation can lead to memory corruption. The identification of this vulnerability is CVE-2026-55639. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in neutrinolabs xrdp up to 0.10.6 and classified as problematic. This vulnerability affects some unknown functionality of the component PDU. The manipulation with an unknown input leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality. CVE summarizes:

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the parsing of Client Security Data within the Client MCS Connect Initial PDU with GCC Conference Create Request during the connection sequence. During the initial capability and security negotiation phase, the parser fails to perform sufficient length validation for the incoming data block. A remote, unauthenticated attacker could potentially exploit this flaw by sending a specially crafted RDP packet containing malformed data. Due to missing bounds checks, the xrdp process may read a small number of bytes beyond the declared data block boundary, potentially disclosing process memory contents that could be combined with other vulnerabilities. This issue has been fixed in version 0.10.6.1.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-55639 since 06/17/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 0.10.6.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• neutrinolabs

Name

• xrdp

Version

• 0.10.0
• 0.10.1
• 0.10.2
• 0.10.3
• 0.10.4
• 0.10.5
• 0.10.6

Website

• Product: https://github.com/neutrinolabs/xrdp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion