PT-2026-33499 · Xrdp · Xrdp

Exploitintel · Published 2026-04-17 · Updated 2026-05-19 · CVE-2026-32624

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.10.6

Description A heap-based buffer overflow exists in the logon processing of this open source RDP server. When the domain user separator is configured in the 'xrdp.ini' file, an unauthenticated remote attacker can send a crafted, excessively long username and domain name to overflow the internal buffer. This memory corruption can lead to a Denial of Service (DoS) or unexpected behavior. This issue only affects systems where the domain name separator directive has been intentionally enabled, as it is commented out by default.

Recommendations Update to version 0.10.6. As a temporary workaround, ensure the domain name separator directive in 'xrdp.ini' remains commented out or disabled.

Fix

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

BDU:2026-06989

CVE-2026-32624

OPENSUSE-SU-2026:10816-1

Affected Products

Xrdp

References · 21

• https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-7q2g-6fjr-h6pp · Vendor Advisory
• https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6 · Patch
• https://ubuntu.com/security/CVE-2026-32624 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-32624 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32624 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32624 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-32624 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06989 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10816-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32624 · Security Note
• https://altsp.su/obnovleniya-bezopasnosti · Note
• https://suse.com/security/cve/CVE-2024-39917 · Note
• https://twitter.com/CVEnew/status/2045467413534101524 · Twitter Post
• https://suse.com/security/cve/CVE-2026-35512 · Note
• https://suse.com/security/cve/CVE-2026-33689 · Note