HighFix available
xrdp — security advisory
xrdp is an open source RDP server. In versions through 0.10.5, the session execution component did not properly handle an error during the privilege drop process. This improper privilege management could allow an authenticated local attacker to escalate privileges to root and execute arbitrary code on the system. An additional exploit would be needed to facilitate this. This issue has been fixed in version 0.10.6.
- Products
- xrdp
- Affected versions
- 0.10.1-3.1, 0.10.1-3.1+deb13u1, 0.10.1-4, 0.10.1-4.1, 0.10.2-1, 0.10.2-2, 0.10.4.1-1, 0.10.4.1-2, 0.10.5-1, 0.10.5-2, 0.10.5-3, 0.10.5-4, 0.10.5-5, 0.9.21.1-1, 0.9.21.1-1+deb12u1, 0.9.21.1-1+deb12u2
- Fixed versions
- 0.10.1-3.1+deb13u2, 0.10.6-1, 0.9.21.1-1+deb12u3
- CVEs
- CVE-2026-32107
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 17:38 UTC · Revision 2
Source evidence
xrdp is an open source RDP server. In versions through 0.10.5, the session execution component did not properly handle an error during the privilege drop process. This improper privilege management could allow an authenticated local attacker to escalate privileges to root and execute arbitrary code on the system. An additional exploit would be needed to facilitate this. This issue has been fixed in version 0.10.6.
osv:DEBIAN-CVE-2026-32107
xrdp
Fixed versions: 0.9.21.1-1+deb12u3
xrdp
Fixed versions: 0.10.1-3.1+deb13u2
xrdp
Fixed versions: 0.10.6-1
Complete source record
{
"id": "064988b57e4e5775b9363c46cdf2317c6c5db149f621fd673ba1430ecad8ced0",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-32107",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-32107",
"summary": "xrdp is an open source RDP server. In versions through 0.10.5, the session execution component did not properly handle an error during the privilege drop process. This improper privilege management could allow an authenticated local attacker to escalate privileges to root and execute arbitrary code on the system. An additional exploit would be needed to facilitate this. This issue has been fixed in version 0.10.6.",
"evidence": "osv:DEBIAN-CVE-2026-32107",
"products": [
{
"name": {
"value": "xrdp",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.9.21.1-1+deb12u3",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "0.9.21.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "0.9.21.1-1+deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "0.9.21.1-1+deb12u2",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "xrdp",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.10.1-3.1+deb13u2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "0.10.1-3.1",
"evidence": "/affected/1/versions"
},
{
"value": "0.10.1-3.1+deb13u1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "xrdp",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.10.6-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "0.10.1-3.1",
"evidence": "/affected/2/versions"
},
{
"value": "0.10.1-4",
"evidence": "/affected/2/versions"
},
{
"value": "0.10.1-4.1",
"evidence": "/affected/2/versions"
},
{
"value": "0.10.2-1",
"evidence": "/affected/2/versions"
},
{
"value": "0.10.2-2",
"evidence": "/affected/2/versions"
},
{
"value": "0.10.4.1-1",
"evidence": "/affected/2/versions"
},
{
"value": "0.10.4.1-2",
"evidence": "/affected/2/versions"
},
{
"value": "0.10.5-1",
"evidence": "/affected/2/versions"
},
{
"value": "0.10.5-2",
"evidence": "/affected/2/versions"
},
{
"value": "0.10.5-3",
"evidence": "/affected/2/versions"
},
{
"value": "0.10.5-4",
"evidence": "/affected/2/versions"
},
{
"value": "0.10.5-5",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2026-32107",
"aliases": [
"DEBIAN-CVE-2026-32107"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.21.1-1+deb12u3"
}
]
}
],
"package": {
"name": "xrdp",
"purl": "pkg:deb/debian/xrdp?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"0.9.21.1-1",
"0.9.21.1-1+deb12u1",
"0.9.21.1-1+deb12u2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-32107.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.1-3.1+deb13u2"
}
]
}
],
"package": {
"name": "xrdp",
"purl": "pkg:deb/debian/xrdp?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"0.10.1-3.1",
"0.10.1-3.1+deb13u1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-32107.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.6-1"
}
]
}
],
"package": {
"name": "xrdp",
"purl": "pkg:deb/debian/xrdp?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"0.10.1-3.1",
"0.10.1-4",
"0.10.1-4.1",
"0.10.2-1",
"0.10.2-2",
"0.10.4.1-1",
"0.10.4.1-2",
"0.10.5-1",
"0.10.5-2",
"0.10.5-3",
"0.10.5-4",
"0.10.5-5"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-32107.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-27T09:47:30.621540210Z",
"provider": "osv",
"upstream": [
"CVE-2026-32107"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-32107"
]
},
"related_cves": [
{
"value": "CVE-2026-32107",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 460935,
"published_at": "2026-04-17T20:16:33.677+00:00"
}