CVE-2026-55238: Buffer Over-read

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Confirm Active PDU, where during the capability negotiation phase, the parser did not perform sufficient length validation for specific capability sets. A remote, unauthenticated...

CVE-2026-54538: Loop with Unreachable Exit Condition

xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the software fails to properly validate the totalLength field within the RDP protocol control header during packet reception. An unauthenticated remote attacker can exploit this vulnerability by sendin...

CVE-2026-41252: Heap-based Buffer Overflow

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp, which allows a heap-based buffer overflow when operating in vnc-any mode. The issue occurs during the handling of RFB protocol color map messages from a VNC server, where incoming color indices ar...

CVE-2026-44978: Improper Input Validation

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulnerability does not affect the default configuration of xrdp. The vulnerability is only exploitable when the security layer is set to...

[SECURITY] Fedora 44 Update: freerdp-3.29.0-1.fc44

The xfreerdp & wlfreerdp Remote Desktop Protocol RDP clients from the FreeR DP project. xfreerdp & wlfreerdp can connect to RDP servers such as Microsoft Windows machines, xrdp and VirtualBox...

[SECURITY] Fedora 43 Update: xrdp-0.10.6.1-1.fc43

xrdp provides a fully functional RDP server compatible with a wide range of RDP clients, including FreeRDP and Microsoft RDP client...

[SECURITY] Fedora 44 Update: xrdp-0.10.6.1-1.fc44

xrdp provides a fully functional RDP server compatible with a wide range of RDP clients, including FreeRDP and Microsoft RDP client...

Fedora 44 : xrdp (2026-05c06fa0a8)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-05c06fa0a8 advisory. Release notes for xrdp v0.10.6.1 2026/07/06 General announcements This release fixes 10 vulnerabilities and 1 regression introduced by a vulnerabili...

Fedora 43 : xrdp (2026-bd0a75766f)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bd0a75766f advisory. Release notes for xrdp v0.10.6.1 2026/07/06 General announcements This release fixes 10 vulnerabilities and 1 regression introduced by a vulnerabili...

[SECURITY] Fedora 44 Update: freerdp-3.28.0-1.fc44

The xfreerdp & wlfreerdp Remote Desktop Protocol RDP clients from the FreeR DP project. xfreerdp & wlfreerdp can connect to RDP servers such as Microsoft Windows machines, xrdp and VirtualBox...

Linux Distros Unpatched Vulnerability : CVE-2026-42218

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in respons...

Linux Distros Unpatched Vulnerability : CVE-2026-41521

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update messages within the vnc-any...

Linux Distros Unpatched Vulnerability : CVE-2026-44978

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This...

Linux Distros Unpatched Vulnerability : CVE-2026-55626

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain...

PT-2026-61003

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.10.6.1 Description A missing bounds check in the server occurs when operating in vnc-any mode during the handling of RFB protocol color map messages from a VNC server. Because incoming color indices are not properly...

PT-2026-61022

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.10.6.1 Description An issue exists during the capability negotiation phase when processing RDP Confirm Active PDU. The parser fails to perform sufficient length validation for specific capability sets. A remote,...

PT-2026-61026

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.10.6.1 Description An issue exists in the processing of Client Control PDUs Protocol Data Units during the RDP connection sequence. The parser fails to perform sufficient length validation before reading specific data...

PT-2026-61006

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.10.6.1 Description A heap-based buffer overflow exists in the virtual channel forwarding mechanism. The process uses a fixed-size buffer without adequate bounds checking when forwarding data from a remote client to the...

PT-2026-61004

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.10.6.1 Description An integer overflow occurs when processing screen update messages in the vnc-any connection mode. A remote VNC server can send crafted image dimensions that cause an integer overflow during memory...

PT-2026-61025

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.10.6.1 Description An issue exists in the parsing of Client Security Data within the Client MCS Connect Initial PDU with GCC Conference Create Request during the connection sequence. During the initial capability and...