SB2026082738 - Debian update for xrdp
Published: August 27, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 17 vulnerabilities.
1) Heap-based buffer overflow (CVE-ID: CVE-2026-41252)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to heap-based buffer overflow in RFB protocol color map message handling in xrdp vnc-any mode when processing crafted color map messages from a VNC server. A remote attacker can send specially crafted messages with out-of-range color indices to execute arbitrary code.
The issue can also result in a denial of service and can be exploited prior to authentication.
2) Out-of-bounds read (CVE-ID: CVE-2026-55645)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds read in Client Control PDU processing when parsing a specially crafted truncated Client Control PDU during the RDP connection sequence. A remote attacker can send a specially crafted truncated Client Control PDU to cause a denial of service.
Because xrdp forks a new process for each connection by default, a crash is unlikely to bring down the entire service.
3) Out-of-bounds read (CVE-ID: CVE-2026-55639)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to out-of-bounds read in the Client Security Data parser when parsing the Client MCS Connect Initial PDU with GCC Conference Create Request during the connection sequence. A remote attacker can send a specially crafted RDP packet containing malformed data to disclose sensitive information.
The issue may read a small number of bytes beyond the declared data block boundary during the initial capability and security negotiation phase.
4) Buffer over-read (CVE-ID: CVE-2026-55238)
CWE-ID: CWE-126 - Buffer over-read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds read in the RDP Confirm Active PDU capability set parser when processing crafted capability negotiation data. A remote attacker can send a specially crafted RDP packet to cause a denial of service.
By default, xrdp forks a new process for each connection, so exploitation is unlikely to bring down the entire service.
5) Infinite loop (CVE-ID: CVE-2026-54538)
CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an infinite loop in RDP packet processing when handling a specially crafted RDP packet with an invalid totalLength field. A remote attacker can send a specially crafted packet to cause a denial of service.
By causing the internal pointer not to advance for specific protocol data unit types, the issue can lead to sustained CPU consumption and service unavailability. Multiple malicious connections may contribute to system-wide resource exhaustion.
6) Out-of-bounds read (CVE-ID: CVE-2026-44978)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds read in the FIPS-specific receive paths when processing a crafted FIPS-protected PDU. A remote attacker can send a crafted FIPS-protected PDU to cause a denial of service.
The issue is only exploitable when the security layer is set to security_layer=negotiate or security_layer=rdp and the crypto level is set to crypt_level=fips. Because a new process is forked for each connection by default, a crash is unlikely to bring down the entire service.
7) Heap-based buffer overflow (CVE-ID: CVE-2026-44178)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code or cause a denial of service.
The vulnerability exists due to heap-based buffer overflow in the virtual channel forwarding mechanism when forwarding data from a remote client to the internal channel server. A remote user can send a specially crafted virtual channel message that exceeds the buffer capacity to execute arbitrary code or cause a denial of service.
8) Observable Response Discrepancy (CVE-ID: CVE-2026-42218)
CWE-ID: CWE-204 - Observable Response Discrepancy
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information via username enumeration.
The vulnerability exists due to observable response discrepancy in the login interface when processing authentication attempts. A remote attacker can measure response timing differences to disclose sensitive information via username enumeration.
9) Integer overflow (CVE-ID: CVE-2026-41521)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.
The vulnerability exists due to integer overflow in screen update message processing in vnc-any mode when processing crafted image dimensions from a VNC server. A remote attacker can send crafted screen update messages to disclose sensitive information or cause a denial of service.
Exploitation requires the vnc-any connection mode or another configuration that allows connections to arbitrary VNC hosts.
10) Improper validation of integrity check value (CVE-ID: CVE-2026-32105)
CWE-ID: CWE-354 - Improper Validation of Integrity Check Value
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to modify encrypted RDP traffic in transit without detection.
The vulnerability exists due to improper validation of integrity check value in the Classic RDP Security layer packet handling when processing encrypted RDP packets. A remote attacker can perform a man-in-the-middle attack to modify encrypted RDP traffic in transit without detection.
It does not affect connections where the TLS security layer is enforced.
11) Heap-based buffer overflow (CVE-ID: CVE-2026-35512)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code or cause a denial of service.
The vulnerability exists due to heap-based buffer overflow in the EGFX channel dynvc processing when processing client-controlled size parameters in specially crafted PDUs. A remote user can send specially crafted PDUs to execute arbitrary code or cause a denial of service.
Pre-authentication reachability is possible, but arbitrary code execution typically requires exploitation after successful user authentication.
12) Out-of-bounds read (CVE-ID: CVE-2026-33689)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.
The vulnerability exists due to out-of-bounds read in the dynamic channel parser when processing a specially crafted sequence of packets during the initial connection phase. A remote attacker can send a specially crafted sequence of packets to disclose sensitive information or cause a denial of service.
The issue is reachable before authentication during RDP message parsing.
13) Out-of-bounds read (CVE-ID: CVE-2026-33516)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.
The vulnerability exists due to out-of-bounds read in the RDP capability exchange handling when processing a specially crafted Confirm Active PDU. A remote attacker can send a specially crafted Confirm Active PDU to disclose sensitive information or cause a denial of service.
The issue can be triggered during the pre-authentication phase.
14) Command injection (CVE-ID: CVE-2026-33145)
CWE-ID: CWE-77 - Command injection
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary commands on the server.
The vulnerability exists due to command injection in xrdp-sesman when processing a client-supplied AlternateShell value during session initialization. A remote user can supply a crafted AlternateShell value to execute arbitrary commands on the server.
The issue occurs when the AllowAlternateShell setting is enabled, which is the default if not explicitly configured, and command execution happens prior to normal window manager startup.
15) Heap-based buffer overflow (CVE-ID: CVE-2026-32624)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service or modify memory.
The vulnerability exists due to heap-based buffer overflow in logon processing when handling a crafted excessively long username and domain name. A remote attacker can send a crafted excessively long username and domain name to cause a denial of service or modify memory.
Only systems where the domain_user_separator setting is configured in xrdp.ini are vulnerable.
16) Heap-based buffer overflow (CVE-ID: CVE-2026-32623)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service.
The vulnerability exists due to heap-based buffer overflow in the NeutrinoRDP channel reassembly logic when processing reassembled fragmented virtual channel data while proxying RDP sessions to another server. A remote attacker can send specially crafted RDP channel data from a downstream server position to execute arbitrary code or cause a denial of service.
The issue only affects environments where the NeutrinoRDP module has been explicitly compiled and enabled, and exploitation requires a malicious downstream RDP server or a man-in-the-middle position.
17) Improper Check for Dropped Privileges (CVE-ID: CVE-2026-32107)
CWE-ID: CWE-273 - Improper Check for Dropped Privileges
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges to root and execute arbitrary code.
The vulnerability exists due to improper check for dropped privileges in the session execution component when handling an error during the privilege drop process. A local user can trigger the flawed privilege drop handling to escalate privileges to root and execute arbitrary code.
Exploitation requires an additional exploit to facilitate the attack.
Remediation
Install update from vendor's website.