MGASA-2026-0566: Updated xrdp package fixes security vulnerabilities
libpaletteupdate Heap Buffer Overflow & RCE. (CVE-2026-41252) libframebufferupdate Has Integer Overflow Heap Info Leak & ASLR Bypass. (CVE-2026-41521) Channel Data Forwarding Fixed-Size Buffer Overflow. (CVE-2026-44178) XRDP is vulnerable to a server timing attack, leading to user enumeration. (CVE-2026-42218) Unchecked FIPS padding length in standard RDP Security causes heap out-of-bounds read in HMAC verification. (CVE-2026-44978) Pre-auth infinite loop via totalLength=0 in TSSHARECONTROLHEADER. (CVE-2026-54538) Malformed Confirm Active capability sets cause out-of-bounds reads. (CVE-2026-55238) No authentication required with Xvnc backend. (CVE-2026-55626) Out-of-bounds read in GCC Conference Create Request CSSECURITY processing (xrdpsecprocessmcsdataCSSECURITY). (CVE-2026-55639) Out-of-bounds read in Client Control PDU processing (xrdprdpprocessdatacontrol). (CVE-2026-55645)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mageia/xrdpto a version that resolves this vulnerability.Fixed in 0.10.6.1-2.mga10
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which systems are most exposed to these issues?
Mageia systems running xrdp are affected by this advisory. Systems that expose xrdp to untrusted RDP clients are particularly exposed because the listed flaws are in RDP protocol and connection processing.
Does exploitation require authentication?
Not for every issue listed. The advisory specifically identifies a no-authentication condition when xrdp uses the Xvnc backend, and also lists pre-authentication infinite-loop processing; other flaws are described in protocol parsing and security processing but their authentication requirements are not stated.
What impact could a successful attack have?
The listed impacts include remote code execution from a heap buffer overflow, information disclosure and ASLR bypass, user enumeration through timing behavior, out-of-bounds reads, and denial of service through a pre-authentication infinite loop.
How can I reduce exposure until the updated package is installed?
Restrict network access to xrdp so that untrusted clients cannot reach the RDP service. Where applicable, avoid using the Xvnc backend because the advisory identifies it as allowing access without authentication.