CVE-2026-32107

Katalog CVE

CVSS 8.8 · High EPSS 0,16%

Kerentanan Improper Check for Dropped Privileges pada neutrinolabs xrdp. Skor CVSS 3.1 8.8 (High) menurut github.com.

Deskripsi (NVD)

xrdp is an open source RDP server. In versions through 0.10.5, the session execution component did not properly handle an error during the privilege drop process. This improper privilege management could allow an authenticated local attacker to escalate privileges to root and execute arbitrary code on the system. An additional exploit would be needed to facilitate this. This issue has been fixed in version 0.10.6.

Rincian

Terbit di NVD

17 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-273: Improper Check for Dropped Privileges

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-p5m6-7m43-pjv9 advisory vendor
• https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6 patch · release notes