Skip to content
Heist/ feed
Back to feed
HighFix available

xrdp — security advisory

Type: advisorySources: OSVAdvisory ID: DEBIAN-CVE-2026-32623

xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow vulnerability in the NeutrinoRDP module. When proxying RDP sessions from xrdp to another server, the module fails to properly validate the size of reassembled fragmented virtual channel data against its allocated memory buffer. A malicious downstream RDP server (or an attacker capable of performing a Man-in-the-Middle attack) could exploit this flaw to cause memory corruption, potentially leading to a Denial of Service (DoS) or Remote Code Execution (RCE). The NeutrinoRDP module is not built by default. This vulnerability only affects environments where the module has been explicitly compiled and enabled. Users can verify if the module is built by checking for --enable-neutrinordp in the output of the xrdp -v command. This issue has been fixed in version 0.10.6.

Products
xrdp
Affected versions
0.10.1-3.1, 0.10.1-3.1+deb13u1, 0.10.1-4, 0.10.1-4.1, 0.10.2-1, 0.10.2-2, 0.10.4.1-1, 0.10.4.1-2, 0.10.5-1, 0.10.5-2, 0.10.5-3, 0.10.5-4, 0.10.5-5, 0.9.21.1-1, 0.9.21.1-1+deb12u1, 0.9.21.1-1+deb12u2
Fixed versions
0.10.1-3.1+deb13u2, 0.10.6-1, 0.9.21.1-1+deb12u3
CVEs
CVE-2026-32623
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 17:50 UTC · Revision 2

Source evidence

DEBIAN-CVE-2026-32623

core-osv · Original source

Published 17 Apr 2026, 20:16 UTC

xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow vulnerability in the NeutrinoRDP module. When proxying RDP sessions from xrdp to another server, the module fails to properly validate the size of reassembled fragmented virtual channel data against its allocated memory buffer. A malicious downstream RDP server (or an attacker capable of performing a Man-in-the-Middle attack) could exploit this flaw to cause memory corruption, potentially leading to a Denial of Service (DoS) or Remote Code Execution (RCE). The NeutrinoRDP module is not built by default. This vulnerability only affects environments where the module has been explicitly compiled and enabled. Users can verify if the module is built by checking for --enable-neutrinordp in the output of the xrdp -v command. This issue has been fixed in version 0.10.6.

osv:DEBIAN-CVE-2026-32623

xrdp

Fixed versions: 0.9.21.1-1+deb12u3

xrdp

Fixed versions: 0.10.1-3.1+deb13u2

xrdp

Fixed versions: 0.10.6-1

Complete source record
{
  "id": "e03b2605a274bf3336284881a9bc1897095678c1c3b7a334c0c5274bb5862e36",
  "url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-32623",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "DEBIAN-CVE-2026-32623",
    "summary": "xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow vulnerability in the NeutrinoRDP module. When proxying RDP sessions from xrdp to another server, the module fails to properly validate the size of reassembled fragmented virtual channel data against its allocated memory buffer. A malicious downstream RDP server (or an attacker capable of performing a Man-in-the-Middle attack) could exploit this flaw to cause memory corruption, potentially leading to a Denial of Service (DoS) or Remote Code Execution (RCE). The NeutrinoRDP module is not built by default. This vulnerability only affects environments where the module has been explicitly compiled and enabled. Users can verify if the module is built by checking for --enable-neutrinordp in the output of the xrdp -v command. This issue has been fixed in version 0.10.6.",
    "evidence": "osv:DEBIAN-CVE-2026-32623",
    "products": [
      {
        "name": {
          "value": "xrdp",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.9.21.1-1+deb12u3",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": [
          {
            "value": "0.9.21.1-1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.9.21.1-1+deb12u1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.9.21.1-1+deb12u2",
            "evidence": "/affected/0/versions"
          }
        ]
      },
      {
        "name": {
          "value": "xrdp",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.10.1-3.1+deb13u2",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": [
          {
            "value": "0.10.1-3.1",
            "evidence": "/affected/1/versions"
          },
          {
            "value": "0.10.1-3.1+deb13u1",
            "evidence": "/affected/1/versions"
          }
        ]
      },
      {
        "name": {
          "value": "xrdp",
          "evidence": "/affected/2/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.10.6-1",
            "evidence": "/affected/2/ranges"
          }
        ],
        "affected_versions": [
          {
            "value": "0.10.1-3.1",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "0.10.1-4",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "0.10.1-4.1",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "0.10.2-1",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "0.10.2-2",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "0.10.4.1-1",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "0.10.4.1-2",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "0.10.5-1",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "0.10.5-2",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "0.10.5-3",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "0.10.5-4",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "0.10.5-5",
            "evidence": "/affected/2/versions"
          }
        ]
      }
    ],
    "severity": "high",
    "structured": {
      "id": "DEBIAN-CVE-2026-32623",
      "aliases": [
        "DEBIAN-CVE-2026-32623"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.9.21.1-1+deb12u3"
                }
              ]
            }
          ],
          "package": {
            "name": "xrdp",
            "purl": "pkg:deb/debian/xrdp?arch=source&distro=bookworm",
            "ecosystem": "Debian:12"
          },
          "versions": [
            "0.9.21.1-1",
            "0.9.21.1-1+deb12u1",
            "0.9.21.1-1+deb12u2"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-32623.json"
          },
          "ecosystem_specific": {
            "urgency": "not yet assigned"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.10.1-3.1+deb13u2"
                }
              ]
            }
          ],
          "package": {
            "name": "xrdp",
            "purl": "pkg:deb/debian/xrdp?arch=source&distro=trixie",
            "ecosystem": "Debian:13"
          },
          "versions": [
            "0.10.1-3.1",
            "0.10.1-3.1+deb13u1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-32623.json"
          },
          "ecosystem_specific": {
            "urgency": "not yet assigned"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.10.6-1"
                }
              ]
            }
          ],
          "package": {
            "name": "xrdp",
            "purl": "pkg:deb/debian/xrdp?arch=source&distro=forky",
            "ecosystem": "Debian:14"
          },
          "versions": [
            "0.10.1-3.1",
            "0.10.1-4",
            "0.10.1-4.1",
            "0.10.2-1",
            "0.10.2-2",
            "0.10.4.1-1",
            "0.10.4.1-2",
            "0.10.5-1",
            "0.10.5-2",
            "0.10.5-3",
            "0.10.5-4",
            "0.10.5-5"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-32623.json"
          },
          "ecosystem_specific": {
            "urgency": "not yet assigned"
          }
        }
      ],
      "modified": "2026-10-27T09:47:42.657921733Z",
      "provider": "osv",
      "upstream": [
        "CVE-2026-32623"
      ],
      "references": [
        "https://security-tracker.debian.org/tracker/CVE-2026-32623"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2026-32623",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 461333,
  "published_at": "2026-04-17T20:16:33.953+00:00"
}