CVE-2026-32623: xrdp: Heap buffer overflow in NeutrinoRDP channel reassembly
xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow vulnerability in the NeutrinoRDP module. When proxying RDP sessions from xrdp to another server, the module fails to properly validate the size of reassembled fragmented virtual channel data against its allocated memory buffer. A malicious downstream RDP server (or an attacker capable of performing a Man-in-the-Middle attack) could exploit this flaw to cause memory corruption, potentially leading to a Denial of Service (DoS) or Remote Code Execution (RCE). The NeutrinoRDP module is not built by default. This vulnerability only affects environments where the module has been explicitly compiled and enabled. Users can verify if the module is built by checking for --enable-neutrinordp in the output of the xrdp -v command. This issue has been fixed in version 0.10.6.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32623?
CVE-2026-32623 has a high severity rating due to the potential for arbitrary code execution resulting from the heap buffer overflow.
How do I fix CVE-2026-32623?
To fix CVE-2026-32623, upgrade xrdp to version 0.10.6 or later where the vulnerability has been patched.
Which versions of xrdp are affected by CVE-2026-32623?
CVE-2026-32623 affects xrdp versions up to and including 0.10.5.
What are the potential impacts of CVE-2026-32623?
The potential impacts of CVE-2026-32623 include remote code execution and system compromise through exploitation of the buffer overflow.
Is there a mitigation for CVE-2026-32623 if I cannot upgrade?
If you cannot upgrade, limiting access to the xrdp server and monitoring logs for suspicious activities are potential mitigations for CVE-2026-32623.