CVE-2026-35512 is a heap-based buffer overflow vulnerability in neutrinolabs xrdp (an open source RDP server) affecting versions before 0.10.6. The vulnerability arises from insufficient validation of client-controlled size parameters in the EGFX graphics dynamic virtual channel implementation, enabling out-of-bounds writes through crafted protocol data units. This can cause a denial of service via process crash pre-authentication or potentially remote code execution post-authentication. The vulnerability has been addressed in xrdp version 0.10.6.

Successful exploitation can cause a denial of service by crashing the xrdp process without authentication. Post-authentication exploitation may allow remote code execution, posing a significant risk to affected systems. The CVSS 4.0 score is 8.7 (high severity), reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Upgrade xrdp to version 0.10.6 or later, where this vulnerability is fixed. If immediate upgrade is not feasible, ensure xrdp runs as a non-privileged user (default since version 0.10.2) to limit the impact of potential exploitation. Monitor vendor advisories for any additional guidance.