CVE-2026-54538 xrdp: Pre-auth infinite loop via totalLength=0 in TS_SHARECONTROLHEADER

xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the software fails to properly validate the totalLength field within the RDP protocol control header during packet reception. An unauthenticated remote attacker can exploit this vulnerability by sendin...

CVE-2026-54538 xrdp: Pre-auth infinite loop via totalLength=0 in TS_SHARECONTROLHEADER

xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the software fails to properly validate the totalLength field within the RDP protocol control header during packet reception. An unauthenticated remote attacker can exploit this vulnerability by sendin...

EUVD-2026-46032

xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the software fails to properly validate the totalLength field within the RDP protocol control header during packet reception. An unauthenticated remote attacker can exploit this vulnerability by sendin...

CVE-2026-44978 xrdp: Unchecked FIPS padding length in standard RDP Security causes heap out-of-bounds read in HMAC verification

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulnerability does not affect the default configuration of xrdp. The vulnerability is only exploitable when the security layer is set to...

CVE-2026-44978

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulnerability does not affect the default configuration of xrdp. The vulnerability is only exploitable when the security layer is set to...

CVE-2026-44978

Summary: xrdp versions up to 0.10.6 contain a heap out-of-bounds read in the FIPS-specific receive paths when non-default security_layer and crypt_level are used. An unauthenticated remote attacker can trigger a denial-of-service by sending a crafted FIPS-protected PDU, via a non-default mode (se...

CVE-2026-44978 xrdp: Unchecked FIPS padding length in standard RDP Security causes heap out-of-bounds read in HMAC verification

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulnerability does not affect the default configuration of xrdp. The vulnerability is only exploitable when the security layer is set to...

CVE-2026-44978 xrdp: Unchecked FIPS padding length in standard RDP Security causes heap out-of-bounds read in HMAC verification

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulnerability does not affect the default configuration of xrdp. The vulnerability is only exploitable when the security layer is set to...

CVE-2026-44178

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer without adequate...

CVE-2026-44178

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer without adequate...

CVE-2026-44178 xrdp: Channel Data Forwarding Fixed-Size Buffer Overflow

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer without adequate...

CVE-2026-44178 xrdp: Channel Data Forwarding Fixed-Size Buffer Overflow

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer without adequate...

EUVD-2026-46028

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer without adequate...

CVE-2026-44178

Technical details are not publicly available in the provided documents. Monitor for updates from vendors and advisories regarding CVE-2026-44178 (xrdp heap-based overflow; fixed in 0.10.6.1).

CVE-2026-55645

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connection sequence, the parser does not perform sufficient length validation before reading specific data fields from the network stream. A remote...

CVE-2026-55645 xrdp: Out-of-bounds read in Client Control PDU processing (xrdp_rdp_process_data_control)

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connection sequence, the parser does not perform sufficient length validation before reading specific data fields from the network stream. A remote...

CVE-2026-55645

CVE-2026-55645 affects xrdp (open source RDP server). The vulnerability is an out-of-bounds read in the processing of Client Control PDUs during the RDP connection sequence, caused by insufficient length validation in the parser before reading data from the network stream. This can allow a remote...

CVE-2026-55645

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connection sequence, the parser does not perform sufficient length validation before reading specific data fields from the network stream. A remote...

CVE-2026-55645 xrdp: Out-of-bounds read in Client Control PDU processing (xrdp_rdp_process_data_control)

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connection sequence, the parser does not perform sufficient length validation before reading specific data fields from the network stream. A remote...

CVE-2026-55645 xrdp: Out-of-bounds read in Client Control PDU processing (xrdp_rdp_process_data_control)

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connection sequence, the parser does not perform sufficient length validation before reading specific data fields from the network stream. A remote...