CVE-2026-44978: CWE-20: Improper Input Validation in neutrinolabs xrdp
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulnerability does not affect the default configuration of xrdp. The vulnerability is only exploitable when the security layer is set to security_layer=negotiate or security_layer=rdp, and the crypto level is changed to crypt_level=fips in xrdp.ini. In this specific non-default mode, the server fails to validate the FIPS padding length field, leading to a pointer underflow and a subsequent negative length calculation. An unauthenticated remote attacker can exploit this by sending a crafted FIPS-protected PDU, causing a heap out-of-bounds read that results in a process crash and denial of service (DoS). However, since xrdp forks a new process for each connection by default, an out-of-bounds read causing a process crash is unlikely to bring down the entire xrdp service. This issue has been fixed in version 0.10.6.1.
AI Analysis
Technical Summary
CVE-2026-44978 is a heap out-of-bounds read vulnerability in neutrinolabs xrdp affecting versions up to and including 0.10.6. The flaw exists in the FIPS-specific receive paths when the server is configured with non-default settings: security_layer set to negotiate or rdp and crypt_level set to fips. The vulnerability arises from improper input validation of the FIPS padding length field, causing a pointer underflow and negative length calculation. This can be exploited by an unauthenticated remote attacker sending a crafted FIPS-protected PDU, leading to a process crash and denial of service. Due to xrdp's default behavior of forking a new process per connection, a single process crash is unlikely to disrupt the entire service. The vulnerability is resolved in version 0.10.6.1.
Potential Impact
An unauthenticated remote attacker can cause a denial of service by triggering a heap out-of-bounds read that crashes the xrdp process handling the connection. There is no impact on confidentiality or integrity. The overall service is unlikely to be fully disrupted due to process forking behavior.
Mitigation Recommendations
Upgrade to xrdp version 0.10.6.1 or later, where this vulnerability has been fixed. If upgrading is not immediately possible, avoid using the non-default configuration settings that enable the vulnerability: do not set security_layer to negotiate or rdp combined with crypt_level=fips. The default configuration is not affected.
CVE-2026-44978: CWE-20: Improper Input Validation in neutrinolabs xrdp
Description
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulnerability does not affect the default configuration of xrdp. The vulnerability is only exploitable when the security layer is set to security_layer=negotiate or security_layer=rdp, and the crypto level is changed to crypt_level=fips in xrdp.ini. In this specific non-default mode, the server fails to validate the FIPS padding length field, leading to a pointer underflow and a subsequent negative length calculation. An unauthenticated remote attacker can exploit this by sending a crafted FIPS-protected PDU, causing a heap out-of-bounds read that results in a process crash and denial of service (DoS). However, since xrdp forks a new process for each connection by default, an out-of-bounds read causing a process crash is unlikely to bring down the entire xrdp service. This issue has been fixed in version 0.10.6.1.
CVSS v3.1
Score 5.3medium
Affected software
pkg:github/neutrinolabs/xrdpRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-44978 is a heap out-of-bounds read vulnerability in neutrinolabs xrdp affecting versions up to and including 0.10.6. The flaw exists in the FIPS-specific receive paths when the server is configured with non-default settings: security_layer set to negotiate or rdp and crypt_level set to fips. The vulnerability arises from improper input validation of the FIPS padding length field, causing a pointer underflow and negative length calculation. This can be exploited by an unauthenticated remote attacker sending a crafted FIPS-protected PDU, leading to a process crash and denial of service. Due to xrdp's default behavior of forking a new process per connection, a single process crash is unlikely to disrupt the entire service. The vulnerability is resolved in version 0.10.6.1.
Potential Impact
An unauthenticated remote attacker can cause a denial of service by triggering a heap out-of-bounds read that crashes the xrdp process handling the connection. There is no impact on confidentiality or integrity. The overall service is unlikely to be fully disrupted due to process forking behavior.
Mitigation Recommendations
Upgrade to xrdp version 0.10.6.1 or later, where this vulnerability has been fixed. If upgrading is not immediately possible, avoid using the non-default configuration settings that enable the vulnerability: do not set security_layer to negotiate or rdp combined with crypt_level=fips. The default configuration is not affected.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-08T16:23:33.264Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5e56f42a4a8d5989689f96
Added to database: 07/20/2026, 17:12:20 UTC
Last enriched: 07/20/2026, 17:27:50 UTC
Last updated: 07/21/2026, 05:47:23 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.