CVE-2026-33689
Out-of-Bounds Read in xrdp Causes Remote DoS, Data Leak
Publication date: 2026-04-17
Last updated on: 2026-04-27
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| neutrinolabs | xrdp | to 0.10.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in xrdp, an open source RDP server, in versions up to 0.10.5. It is an out-of-bounds read flaw in the pre-authentication RDP message parsing logic.
A remote, unauthenticated attacker can exploit this by sending a specially crafted sequence of packets during the initial connection phase.
The root cause is insufficient validation of input buffer lengths before processing dynamic channel communication.
Exploitation can cause a denial-of-service (DoS) via process crash or potentially disclose sensitive information from the service's memory.
This vulnerability was fixed in version 0.10.6.
How can this vulnerability impact me? :
If exploited, this vulnerability can lead to a denial-of-service condition by crashing the xrdp process, disrupting remote desktop services.
Additionally, there is a risk of sensitive information disclosure from the service's memory space, which could compromise confidentiality.
Since the attacker can be remote and unauthenticated, the risk is higher as no prior access is needed.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade the xrdp server to version 0.10.6 or later, where the issue has been fixed.
Since the vulnerability allows remote unauthenticated attackers to cause denial-of-service or information disclosure, restricting access to the xrdp service from untrusted networks can also help reduce risk until the upgrade is applied.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in xrdp versions through 0.10.5 can lead to potential disclosure of sensitive information from the service's memory space. Such unauthorized disclosure of sensitive data could impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access or leaks.
Additionally, the denial-of-service condition caused by this vulnerability could affect system availability, which is also a consideration under some compliance frameworks.
However, the provided information does not explicitly detail the compliance impact or mitigation steps related to these standards.