CVE-2026-54538: xrdp: Pre-auth infinite loop via totalLength=0 in TS_SHARECONTROLHEADER
xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the software fails to properly validate the totalLength field within the RDP protocol control header during packet reception. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted packet that forces the xrdp process or thread into an infinite, CPU-bound loop. Because the internal pointer fails to advance and the deadlock prevention mechanism is bypassed for specific protocol data unit types, the process consumes excessive CPU resources indefinitely. This can render the xrdp service unavailable and potentially lead to system-wide resource exhaustion if multiple malicious connections are established. This issue has been fixed in version 0.10.6.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
xrdpto a version that resolves this vulnerability.Fixed in 0.10.6.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54538?
The severity of CVE-2026-54538 is high with a CVSS score of 7.5.
How do I fix CVE-2026-54538?
To fix CVE-2026-54538, upgrade xrdp to version 0.10.6.1 or later.
What impact does CVE-2026-54538 have on my system?
CVE-2026-54538 allows an unauthenticated remote attacker to cause an infinite loop, potentially leading to a denial of service.
Which versions of xrdp are affected by CVE-2026-54538?
xrdp versions 0.10.6 and earlier are affected by CVE-2026-54538.
What type of attack is associated with CVE-2026-54538?
CVE-2026-54538 is associated with an unauthenticated remote denial of service attack.