Infinite loop in xrdp - CVE-2026-54538

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU136785

Infinite loop in xrdp - CVE-2026-54538

Published: July 2, 2026


Vulnerability identifier: #VU136785
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-54538
CWE-ID: CWE-835
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an infinite loop in RDP packet processing when handling a specially crafted RDP packet with an invalid totalLength field. A remote attacker can send a specially crafted packet to cause a denial of service.

By causing the internal pointer not to advance for specific protocol data unit types, the issue can lead to sustained CPU consumption and service unavailability. Multiple malicious connections may contribute to system-wide resource exhaustion.


Affected software

xrdp
Fedora
Anolis OS
xrdp-devel
xrdp
xrdp-selinux
xrdp-doc

How to mitigate CVE-2026-54538

Install security update from vendor's website.

xrdp - update to 0.10.6.1
xrdp-devel - update to 0.10.6.1-1
xrdp - update to 0.10.6.1-1
xrdp-selinux - update to 0.10.6.1-1
xrdp-doc - update to 0.10.6.1-1
xrdp - addressed in versions 0.10.6.1-1.el8, 0.10.6.1-1.el9, 0.10.6.1-1.fc43, 0.10.6.1-1.fc44

External References

Related Security Bulletins