CVE-2026-41252: xrdp: Unvalidated Color Index Can Cause Remote Code Execution

Summary

Versions of xrdp prior to 0.10.6 contain a security flaw that can be exploited by a malicious VNC server to execute unauthorized code on a remote system. This can happen before the user even logs in, making it a serious concern for organizations using xrdp for remote access. To protect against this issue, update to version 0.10.6.1 or later.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions
neutrinolabs	xrdp	< 0.10.6.1

Original title

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp, which allows a heap-based buffer overflow when operating in vnc-any mode. The issue occurs durin...

Original description

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp, which allows a heap-based buffer overflow when operating in vnc-any mode. The issue occurs during the handling of RFB protocol color map messages from a VNC server, where incoming color indices are not properly validated. A malicious VNC server can exploit this flaw by sending crafted messages with out-of-range values, leading to an out-of-bounds write on the heap. This memory corruption can result in a denial of service (DoS) or potentially allow remote code execution (RCE) prior to authentication. This issue has been fixed in version 0.10.6.1.

nvd CVSS3.1 9.8

Vulnerability type

CWE-122 Heap-based Buffer Overflow