CVE-2026-41252
Received Received - Intake

Heap-based Buffer Overflow in xrdp via VNC Color Map

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp, which allows a heap-based buffer overflow when operating in vnc-any mode. The issue occurs during the handling of RFB protocol color map messages from a VNC server, where incoming color indices are not properly validated. A malicious VNC server can exploit this flaw by sending crafted messages with out-of-range values, leading to an out-of-bounds write on the heap. This memory corruption can result in a denial of service (DoS) or potentially allow remote code execution (RCE) prior to authentication. This issue has been fixed in version 0.10.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-41252
EUVD
EUVD-2026-46017

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
neutrinolabs xrdp to 0.10.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap-based buffer overflow in xrdp, an open-source RDP server. It occurs when xrdp operates in vnc-any mode and fails to validate color indices from RFB protocol messages sent by a VNC server. A malicious VNC server can exploit this by sending out-of-range values, causing an out-of-bounds write on the heap. This can lead to denial of service or remote code execution before authentication.

Detection Guidance

To detect this vulnerability, check the xrdp version running on your system. If it is 0.10.6 or earlier, the system is vulnerable. Use commands like 'xrdp --version' or check package managers (e.g., 'dpkg -l xrdp' for Debian-based systems). Monitor network traffic for unusual VNC protocol messages, especially color map requests with out-of-range values.

Impact Analysis

If you use xrdp in vnc-any mode, a malicious VNC server could exploit this flaw to crash your system (DoS) or execute arbitrary code remotely without authentication. This could allow attackers to gain control over your system, steal data, or disrupt services.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA due to its potential for unauthorized remote code execution (RCE) and denial of service (DoS) before authentication. GDPR requires protecting personal data from unauthorized access, and HIPAA mandates safeguarding protected health information. A successful exploit could lead to data breaches or system compromises, violating these regulations.

Mitigation Strategies

Immediately upgrade xrdp to version 0.10.6.1 or later. If upgrading is not possible, disable the vnc-any mode by removing or commenting out the [vnc-any] section in /etc/xrdp/xrdp.ini. Ensure no custom sections allow arbitrary VNC host connections. Restart the xrdp service after changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-41252. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart