Vulnerability · Published Jul 20, 2026 · Assigned by GitHub_M
CVE-2026-44978xrdp: Unchecked FIPS padding length in standard RDP Security causes heap out-of-bounds read in HMAC verification
Medium 5.3
In plain English
A medium-severity improper input validation in xrdp from neutrinolabs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulnerability does not affect the default configuration of xrdp. The vulnerability is only exploitable when the security layer is set to security_layer=negotiate or security_layer=rdp, and the crypto level is changed to crypt_level=fips in xrdp.ini. In this specific non-default mode, the server fails to validate the FIPS padding length field, leading to a pointer underflow and a subsequent negative length calculation. An unauthenticated remote attacker can exploit this by sending a crafted FIPS-protected PDU, causing a heap out-of-bounds read that results in a process crash and denial of service (DoS). However, since xrdp forks a new process for each connection by default, an out-of-bounds read causing a process crash is unlikely to bring down the entire xrdp service. This issue has been fixed in version 0.10.6.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | xrdp | 0.9.21.1-1+deb12u3 | DEBIAN-CVE-2026-44978 |
| Debian:13 | xrdp | 0.10.1-3.1+deb13u2 | DEBIAN-CVE-2026-44978 |
| Debian:14 | xrdp | 0.10.6.1-2 | DEBIAN-CVE-2026-44978 |
| Ubuntu:22.04:LTS | xrdp | no fix listed | UBUNTU-CVE-2026-44978 |
| Ubuntu:24.04:LTS | xrdp | no fix listed | UBUNTU-CVE-2026-44978 |
| Ubuntu:25.10 | xrdp | no fix listed | UBUNTU-CVE-2026-44978 |
| Ubuntu:26.04:LTS | xrdp | no fix listed | UBUNTU-CVE-2026-44978 |
| Ubuntu:26.10 | xrdp | no fix listed | UBUNTU-CVE-2026-44978 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| neutrinolabs | xrdp | < 0.10.6.1 |
Weakness: CWE-20, CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-9cg5-f7m7-ppvj x_refsource_CONFIRM
- https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1 x_refsource_MISC