CVE-2026-33689 Details
Description
xrdp is an open source RDP server. Versions through 0.10.5 have an out-of-bounds read vulnerability in the pre-authentication RDP message parsing logic. A remote, unauthenticated attacker can trigger this flaw by sending a specially crafted sequence of packets during the initial connection phase. This vulnerability results from insufficient validation of input buffer lengths before processing dynamic channel communication. Successful exploitation can lead to a denial-of-service (DoS) condition via a process crash or potential disclosure of sensitive information from the service's memory space. This issue has been fixed in version 0.10.6.
A denial-of-service vulnerability has been identified in xrdp versions prior to 0.10.6. This issue arises from an out-of-bounds read in the pre-authentication RDP message parsing, which can be exploited by remote, unauthenticated attackers. The vulnerability is caused by inadequate validation of input buffer lengths before handling dynamic channel communication. Exploitation of this flaw can lead to a process crash, causing a denial-of-service condition, or potentially allow the disclosure of sensitive information from the service's memory.
Users can upgrade to xrdp version 0.10.6 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6 | [email protected] | PatchRelease Notes |
| https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-92mr-6wpp-27jj | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| neutrinolabs xrdp | < 0.10.6 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 17, 2026 | New CVE Received | [email protected] |