The vulnerability in neutrinolabs xrdp (CVE-2026-32107) involves improper checking for dropped privileges (CWE-273) in versions up to 0.10.5. Specifically, the session execution component does not correctly handle errors during the privilege drop process, potentially allowing an authenticated local attacker to escalate privileges to root and execute arbitrary code. This privilege escalation requires the attacker to be authenticated locally and to chain this issue with another exploit. The issue is resolved in version 0.10.6.

An authenticated local attacker on affected versions of xrdp can escalate privileges to root and execute arbitrary code on the system. This could lead to full system compromise. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.

Upgrade neutrinolabs xrdp to version 0.10.6 or later, where this vulnerability has been fixed. Since this is a local privilege escalation requiring authentication, applying the official patch is the primary recommended mitigation. No vendor advisory was provided to indicate alternative mitigations or that no action is required.