CVE-2026-44978
Received Received - Intake

Heap Out-of-Bounds Read in xrdp

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulnerability does not affect the default configuration of xrdp. The vulnerability is only exploitable when the security layer is set to security_layer=negotiate or security_layer=rdp, and the crypto level is changed to crypt_level=fips in xrdp.ini. In this specific non-default mode, the server fails to validate the FIPS padding length field, leading to a pointer underflow and a subsequent negative length calculation. An unauthenticated remote attacker can exploit this by sending a crafted FIPS-protected PDU, causing a heap out-of-bounds read that results in a process crash and denial of service (DoS). However, since xrdp forks a new process for each connection by default, an out-of-bounds read causing a process crash is unlikely to bring down the entire xrdp service. This issue has been fixed in version 0.10.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-44978
EUVD
EUVD-2026-46030

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
neutrinolabs xrdp to 0.10.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap out-of-bounds read vulnerability in xrdp versions 0.10.6 and earlier. It only affects non-default configurations where the security layer is set to negotiate or rdp and crypto level is set to fips in xrdp.ini. The server fails to validate the FIPS padding length field, causing a pointer underflow and negative length calculation. An attacker can send a crafted FIPS-protected PDU to trigger a heap out-of-bounds read, crashing the process and causing a denial of service.

Detection Guidance

Check if xrdp is running with the vulnerable configuration by inspecting xrdp.ini for security_layer=negotiate or security_layer=rdp and crypt_level=fips. Monitor for process crashes in xrdp child processes during FIPS-protected PDU handling.

Impact Analysis

The impact is limited to individual xrdp connections rather than the entire service because xrdp forks a new process for each connection. An attacker could cause a denial of service for a single connection by crashing the process. No privileges or user interaction are required for exploitation, and the attack can be performed remotely over the network.

Compliance Impact

This vulnerability primarily causes a denial of service (DoS) by crashing individual xrdp processes, which does not directly impact data confidentiality or integrity. However, a DoS condition could disrupt services that handle sensitive data, potentially affecting compliance with GDPR or HIPAA if critical systems become unavailable. The vulnerability only affects non-default configurations with specific FIPS settings, limiting its scope.

Mitigation Strategies

Upgrade xrdp to version 0.10.6.1 or later. If FIPS mode is required, ensure proper input validation is implemented. Disable non-default security_layer and crypt_level configurations if not necessary.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44978. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart