Vulnerability Details CVE-2026-44178
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer without adequate bounds checking on the incoming payload. An authenticated remote attacker can exploit this flaw by sending a specially crafted virtual channel message that exceeds the buffer capacity, leading to heap memory corruption. This may result in a denial of service or the execution of arbitrary code with the privileges of the xrdp process. This issue has been fixed in version 0.10.6.1.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.009
EPSS Ranking 55.4%
CVSS Severity
CVSS v3 Score 8.8
References
Products affected by CVE-2026-44178
-
cpe:2.3:a:neutrinolabs:xrdp:-
-
cpe:2.3:a:neutrinolabs:xrdp:0.10.0
-
cpe:2.3:a:neutrinolabs:xrdp:0.10.1
-
cpe:2.3:a:neutrinolabs:xrdp:0.10.2
-
cpe:2.3:a:neutrinolabs:xrdp:0.10.3
-
cpe:2.3:a:neutrinolabs:xrdp:0.10.4
-
cpe:2.3:a:neutrinolabs:xrdp:0.10.4.1
-
cpe:2.3:a:neutrinolabs:xrdp:0.10.5
-
cpe:2.3:a:neutrinolabs:xrdp:0.10.6
-
cpe:2.3:a:neutrinolabs:xrdp:0.6.0
-
cpe:2.3:a:neutrinolabs:xrdp:0.6.1
-
cpe:2.3:a:neutrinolabs:xrdp:0.6.2
-
cpe:2.3:a:neutrinolabs:xrdp:0.8.0
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.1
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.10
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.11
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.12
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.13
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.13.1
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.14
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.15
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.16
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.17
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.18
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.18.1
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.19
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.2
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.20
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.21
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.21.1
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.22
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.22.1
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.23
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.23.1
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.24
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.25
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.25.1
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.26
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.27
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.3
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.3.1
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.4
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.4.
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.5
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.6
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.7
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.8
-
cpe:2.3:a:neutrinolabs:xrdp:0.9.9