Buffer over-read in xrdp - CVE-2026-55238
Published: July 1, 2026
Vulnerability identifier: #VU136615
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-55238
CWE-ID: CWE-126
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds read in the RDP Confirm Active PDU capability set parser when processing crafted capability negotiation data. A remote attacker can send a specially crafted RDP packet to cause a denial of service.
By default, xrdp forks a new process for each connection, so exploitation is unlikely to bring down the entire service.
Affected software
xrdp
Debian Linux
Fedora
xrdp (Debian package)
xrdp
Debian Linux
Fedora
xrdp (Debian package)
xrdp
How to mitigate CVE-2026-55238
Install security update from vendor's website.
xrdp - update to 0.10.6.1
xrdp (Debian package) - update to 0.10.1-3.1+deb13u2
xrdp - addressed in versions 0.10.6.1-1.el8, 0.10.6.1-1.el9, 0.10.6.1-1.fc43, 0.10.6.1-1.fc44
xrdp (Debian package) - update to 0.10.1-3.1+deb13u2
xrdp - addressed in versions 0.10.6.1-1.el8, 0.10.6.1-1.el9, 0.10.6.1-1.fc43, 0.10.6.1-1.fc44