CVE-2026-54538
Received Received - Intake

Denial of Service in xrdp via RDP Header Manipulation

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the software fails to properly validate the totalLength field within the RDP protocol control header during packet reception. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted packet that forces the xrdp process or thread into an infinite, CPU-bound loop. Because the internal pointer fails to advance and the deadlock prevention mechanism is bypassed for specific protocol data unit types, the process consumes excessive CPU resources indefinitely. This can render the xrdp service unavailable and potentially lead to system-wide resource exhaustion if multiple malicious connections are established. This issue has been fixed in version 0.10.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-54538
EUVD
EUVD-2026-46032

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
neutrinolabs xrdp to 0.10.6 (exc)
neutrinolabs xrdp 0.10.6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an infinite loop denial-of-service flaw in xrdp, an open-source RDP server. It affects versions up to 0.10.6. The issue occurs when the software fails to validate the totalLength field in the RDP control header properly. An unauthenticated remote attacker can send a specially crafted packet that causes the xrdp process to enter an endless CPU-bound loop, consuming excessive resources and making the service unavailable.

Detection Guidance

Monitor xrdp process CPU usage for unexpected spikes. Check for repeated malformed RDP packets in network traffic. Use tools like tcpdump or Wireshark to inspect RDP control headers for invalid totalLength fields.

Impact Analysis

This vulnerability can render the xrdp service unavailable due to excessive CPU consumption. If multiple malicious connections are established, it may lead to system-wide resource exhaustion, causing broader service disruptions.

Compliance Impact

This vulnerability primarily impacts availability by causing excessive CPU consumption and service unavailability. While not directly violating GDPR or HIPAA, prolonged service disruption could hinder access to personal or health data, potentially affecting compliance with availability requirements under these regulations.

Mitigation Strategies

Upgrade xrdp to version 0.10.6.1 or later immediately. If upgrading is not possible, restrict network access to the RDP port (default 3389) using firewalls. Disable xrdp service if not in use.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54538. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart