PT-2026-33488 · Xrdp · Xrdp

Exploitintel · Published 2026-04-17 · Updated 2026-05-19 · CVE-2026-32107

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.10.6

Description The session execution component of this open source RDP server fails to properly handle errors during the privilege drop process. This improper privilege management allows an authenticated local attacker to escalate privileges to root and execute arbitrary code on the system, although an additional exploit is required to facilitate this.

Recommendations Update to version 0.10.6.

Fix

Weakness Enumeration

CWE-273

Related Identifiers

BDU:2026-06986

CVE-2026-32107

OPENSUSE-SU-2026:10816-1

Affected Products

Xrdp

References · 19

• https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-p5m6-7m43-pjv9 · Vendor Advisory
• https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6 · Patch
• https://bdu.fstec.ru/vul/2026-06986 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-32107 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32107 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-32107 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32107 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32107 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10816-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-32107 · Vendor Advisory
• https://altsp.su/obnovleniya-bezopasnosti · Note
• https://suse.com/security/cve/CVE-2024-39917 · Note
• https://suse.com/security/cve/CVE-2026-35512 · Note
• https://suse.com/security/cve/CVE-2026-33689 · Note
• https://suse.com/security/cve/CVE-2026-32105 · Note