CVE-2026-41252
A heap-based buffer overflow exists in xrdp versions 0.10.6 and earlier when handling VNC color map messages. A malicious VNC server can send crafted data that overflows the heap, causing the server to crash or potentially execute arbitrary code before authentication. The flaw is fixed in xrdp 0.10.6.1.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
xrdp open‑source RDP server, versions 0.10.6 and earlier.
Real-world impact
An attacker controlling a VNC server can send specially crafted messages to a vulnerable xrdp instance, causing the server to crash or potentially execute arbitrary code without needing to authenticate.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can be exploited over the network with no authentication or user interaction, and it can compromise confidentiality, integrity, and availability.
What to do about it
- 01Upgrade xrdp to version 0.10.6.1 or later.
- 02Restart the xrdp service.
NVD-referenced vendor advisory
Timeline
- Jul 20, 2026 · 13d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 13d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 23, 2026 · 10d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- github.com/neutrinolabs/xrdp/releases/…release notes
- github.com/neutrinolabs/xrdp/security/…mitigationvendor advisory