CVE-2026-44978: xrdp: Unchecked FIPS padding length in standard RDP Security causes heap out-of-bounds read in HMAC verification
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulnerability does not affect the default configuration of xrdp. The vulnerability is only exploitable when the security layer is set to securitylayer=negotiate or securitylayer=rdp, and the crypto level is changed to cryptlevel=fips in xrdp.ini. In this specific non-default mode, the server fails to validate the FIPS padding length field, leading to a pointer underflow and a subsequent negative length calculation. An unauthenticated remote attacker can exploit this by sending a crafted FIPS-protected PDU, causing a heap out-of-bounds read that results in a process crash and denial of service (DoS). However, since xrdp forks a new process for each connection by default, an out-of-bounds read causing a process crash is unlikely to bring down the entire xrdp service. This issue has been fixed in version 0.10.6.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
xrdpto a version that resolves this vulnerability.Fixed in 0.10.6.1 - Configuration
To avoid the vulnerable code paths, do not run xrdp with security_layer=negotiate or security_layer=rdp when using FIPS (crypt_level=fips). Use a security_layer other than 'negotiate' or 'rdp' in xrdp.ini (exact safe value not specified in the provided text).
xrdp.ini security_layer = (ensure NOT negotiate/rdp) - Configuration
If you must avoid the vulnerable FIPS receive paths, do not set crypt_level=fips in xrdp.ini while using the affected security_layer values (security_layer=negotiate or security_layer=rdp).
xrdp.ini crypt_level = (ensure NOT fips) - Compensating control
Because xrdp forks a new process per connection by default, DoS impact is limited; nevertheless, monitor for repeated process crashes/DoS conditions and ensure the service remains supervised/HA so overall availability is maintained.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44978?
CVE-2026-44978 has a medium severity rating of 5.3.
What is the impact of CVE-2026-44978 on xrdp?
CVE-2026-44978 can cause a heap out-of-bounds read during HMAC verification in xrdp if specific security configurations are used.
How do I fix CVE-2026-44978?
To remediate CVE-2026-44978, upgrade xrdp to version 0.10.6.1 or later.
Which versions of xrdp are affected by CVE-2026-44978?
xrdp versions 0.10.6 and prior are affected by CVE-2026-44978.
Is the default configuration of xrdp safe from CVE-2026-44978?
No, the vulnerability does not affect the default configuration of xrdp.