CVE-2026-44178
Received Received - Intake

Heap-based Buffer Overflow in xrdp

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer without adequate bounds checking on the incoming payload. An authenticated remote attacker can exploit this flaw by sending a specially crafted virtual channel message that exceeds the buffer capacity, leading to heap memory corruption. This may result in a denial of service or the execution of arbitrary code with the privileges of the xrdp process. This issue has been fixed in version 0.10.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-44178
EUVD
EUVD-2026-46028

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
neutrinolabs xrdp to 0.10.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap-based buffer overflow in xrdp versions 0.10.6 and earlier. It occurs in the virtual channel forwarding mechanism where the xrdp process uses a fixed-size buffer without proper bounds checking on incoming payloads. An authenticated remote attacker can send a specially crafted message that exceeds the buffer size, causing heap memory corruption which may lead to denial of service or arbitrary code execution with xrdp privileges.

Detection Guidance

To detect this vulnerability, check the version of xrdp installed on your system. If it is version 0.10.6 or earlier, the system is vulnerable. Use commands like 'xrdp --version' or check package managers (e.g., 'dpkg -l xrdp' for Debian-based systems or 'rpm -qa xrdp' for RPM-based systems).

Monitor network traffic for unusual virtual channel messages targeting xrdp services. Inspect logs for crashes or memory corruption errors in xrdp processes.

Impact Analysis

An attacker could exploit this to crash the xrdp service causing a denial of service. In some cases, they might execute arbitrary code with the same privileges as the xrdp process, potentially gaining control over the system. This requires an authenticated remote connection to the vulnerable xrdp server.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches if exploited, potentially violating GDPR's integrity and confidentiality requirements or HIPAA's security rules for protected health information. Organizations must patch to maintain compliance.

Mitigation Strategies

Upgrade xrdp to version 0.10.6.1 or later immediately. This patched version addresses the heap-based buffer overflow vulnerability. Disable xrdp services if not in use to reduce attack surface.

Restrict network access to xrdp ports (default 3389) using firewalls. Ensure only trusted clients can connect. Monitor for suspicious activity or unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44178. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart