Log in Start free

Vulnerability · Published Apr 17, 2026 · Assigned by GitHub_M

CVE-2026-35512xrdp: Heap buffer overflow in EGFX channel

High 8.7

In plain English

A high-severity heap buffer overflow in xrdp from neutrinolabs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.6%top 51.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

xrdp is an open source RDP server. Versions through 0.10.5 have a heap-based buffer overflow in the EGFX (graphics dynamic virtual channel) implementation due to insufficient validation of client-controlled size parameters, allowing an out-of-bounds write via crafted PDUs. Pre-authentication exploitation can crash the process, while post-authentication exploitation may achieve remote code execution. This issue has been fixed in version 0.10.6. If users are unable to immediately update, they should run xrdp as a non-privileged user (default since 0.10.2) to limit the impact of successful exploitation.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.23xrdp0.10.6-r0ALPINE-CVE-2026-35512
Alpine:v3.24xrdp0.10.6-r0ALPINE-CVE-2026-35512
Debian:13xrdp0.10.1-3.1+deb13u2DEBIAN-CVE-2026-35512
Debian:14xrdp0.10.6-1DEBIAN-CVE-2026-35512
Ubuntu:22.04:LTSxrdpno fix listedUBUNTU-CVE-2026-35512
Ubuntu:24.04:LTSxrdpno fix listedUBUNTU-CVE-2026-35512
Ubuntu:25.10xrdpno fix listedUBUNTU-CVE-2026-35512
Ubuntu:26.04:LTSxrdpno fix listedUBUNTU-CVE-2026-35512
Ubuntu:26.10xrdpno fix listedUBUNTU-CVE-2026-35512

Affected products (as reported)

VendorProductVersions
neutrinolabs xrdp < 0.10.6

Weakness: CWE-122 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References