CVE-2026-44178

Katalog CVE

CVSS 8.8 · High EPSS 0,88%

Kerentanan Heap-based Buffer Overflow pada neutrinolabs xrdp. Skor CVSS 3.1 8.8 (High) menurut github.com.

Deskripsi (NVD)

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer without adequate bounds checking on the incoming payload. An authenticated remote attacker can exploit this flaw by sending a specially crafted virtual channel message that exceeds the buffer capacity, leading to heap memory corruption. This may result in a denial of service or the execution of arbitrary code with the privileges of the xrdp process. This issue has been fixed in version 0.10.6.1.

Rincian

Terbit di NVD

20 Juli 2026

Terakhir diubah

23 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow

EPSS (30 hari)

0,88% peluang dieksploitasi; lebih tinggi dari 58,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-hh7r-2rmq-q4g4 advisory vendor
• https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1 release notes