SB20260728126 - Anolis OS update for xrdp

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260728126

SB20260728126 - Anolis OS update for xrdp

Published: July 28, 2026

Security Bulletin ID SB20260728126
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Infinite loop (CVE-ID: CVE-2026-54538)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an infinite loop in RDP packet processing when handling a specially crafted RDP packet with an invalid totalLength field. A remote attacker can send a specially crafted packet to cause a denial of service.

By causing the internal pointer not to advance for specific protocol data unit types, the issue can lead to sustained CPU consumption and service unavailability. Multiple malicious connections may contribute to system-wide resource exhaustion.


Remediation

Install update from vendor's website.

References