CVE-2026-32105: xrdp Information Disclosure Vulnerability

CVE-2026-32105 Overview

CVE-2026-32105 is a critical integrity verification bypass vulnerability in xrdp, an open source Remote Desktop Protocol (RDP) server. The vulnerability exists in versions through 0.10.5 where xrdp fails to implement proper verification for the Message Authentication Code (MAC) signature of encrypted RDP packets when using the "Classic RDP Security" layer. While the sender correctly generates 8-byte integrity signatures, the receiving logic lacks the necessary implementation to validate these signatures, causing them to be silently ignored.

Critical Impact

An unauthenticated attacker with man-in-the-middle (MITM) capabilities can exploit this missing MAC verification check to modify encrypted RDP traffic in transit without detection, potentially compromising session integrity and enabling data manipulation attacks.

Affected Products

• xrdp versions through 0.10.5
• Systems using "Classic RDP Security" layer configuration
• Deployments not enforcing TLS security layer

Discovery Timeline

• 2026-04-17 - CVE CVE-2026-32105 published to NVD
• 2026-04-20 - Last updated in NVD database

Technical Details for CVE-2026-32105

Vulnerability Analysis

This vulnerability is classified as CWE-354 (Improper Validation of Integrity Check Value), which occurs when software fails to properly validate cryptographic integrity signatures. In the case of xrdp, the RDP protocol's "Classic RDP Security" layer includes a mechanism for generating and verifying Message Authentication Codes (MACs) to ensure packet integrity. However, the xrdp implementation has a fundamental flaw: while it correctly generates the 8-byte MAC signatures on outbound packets, the inbound packet processing logic completely lacks the verification step.

The attack surface is network-accessible, requiring no authentication or user interaction to exploit. An attacker positioned as a man-in-the-middle can intercept RDP packets, modify their contents, and forward them to the target without the recipient detecting the tampering. This breaks the fundamental integrity guarantee that MAC signatures are designed to provide.

The vulnerability does not affect connections where TLS security layer is enforced, as TLS provides its own robust integrity verification mechanisms that supersede the Classic RDP Security layer's MAC checking.

Root Cause

The root cause of CVE-2026-32105 is an incomplete implementation of the RDP security protocol in xrdp. The Classic RDP Security specification mandates that receiving endpoints must verify the MAC signature attached to each encrypted packet before processing its contents. In vulnerable xrdp versions, this verification step was never implemented in the receiving code path. The signature generation code exists and functions correctly, but the corresponding validation logic is entirely missing, creating an asymmetric security posture where integrity protection exists in name only.

Attack Vector

The attack requires network-level access to position the attacker between the RDP client and the xrdp server. A successful man-in-the-middle attack can be established through various means including ARP spoofing, DNS poisoning, BGP hijacking, or compromised network infrastructure.

Once positioned, the attacker intercepts encrypted RDP traffic flowing between client and server. Because the xrdp server does not verify MAC signatures, the attacker can modify packet contents while maintaining valid encryption. This enables various attacks including injecting keystrokes, altering displayed content, or manipulating file transfers occurring over the RDP session.

The attack is particularly dangerous because it operates at the protocol level and leaves no obvious indicators to the end user. The encrypted session continues to function normally from the user's perspective while the attacker manipulates traffic.

Detection Methods for CVE-2026-32105

Indicators of Compromise

• Unexpected network latency or packet timing anomalies in RDP sessions that may indicate MITM interception
• ARP table inconsistencies or duplicate MAC addresses on network segments hosting xrdp servers
• Unusual network topology changes or routing anomalies affecting RDP traffic paths
• Discrepancies between expected and actual RDP session behavior reported by users

Detection Strategies

• Monitor xrdp configuration files (xrdp.ini) for security_layer settings not set to tls
• Implement network intrusion detection rules to identify potential ARP spoofing or MITM positioning attacks
• Audit xrdp version deployments across infrastructure to identify instances running versions 0.10.5 or earlier
• Deploy network traffic analysis to detect anomalies in RDP session patterns

Monitoring Recommendations

• Enable verbose logging on xrdp servers to capture connection security layer negotiation details
• Implement continuous configuration monitoring for xrdp.ini files to detect unauthorized security layer changes
• Monitor for TLS certificate warnings or failures that may indicate MITM attempts when TLS is enforced
• Establish baseline network behavior metrics for RDP traffic to facilitate anomaly detection

How to Mitigate CVE-2026-32105

Immediate Actions Required

• Upgrade xrdp to version 0.10.6 or later which includes the proper MAC signature verification implementation
• If immediate upgrade is not possible, configure xrdp.ini to enforce TLS security layer by setting security_layer=tls
• Audit all xrdp deployments to inventory affected systems and prioritize remediation
• Review network segmentation to limit exposure of xrdp servers to potential MITM attacks

Patch Information

The vulnerability has been fixed in xrdp version 0.10.6. The patch implements proper MAC signature verification in the receiving code path for Classic RDP Security layer connections. Users should update to this version as soon as possible.

For additional details, refer to the GitHub Release v0.10.6 and the GitHub Security Advisory GHSA-j2jm-c596-c5q3.

Workarounds

• Configure security_layer=tls in xrdp.ini to enforce TLS security, which provides independent integrity verification
• Implement network-level protections such as 802.1X authentication and dynamic ARP inspection to prevent MITM positioning
• Deploy xrdp servers on isolated network segments with strict access controls
• Use VPN tunnels for RDP traffic to provide an additional encryption and integrity layer

# Configuration example - Enforce TLS security in xrdp.ini
# Edit /etc/xrdp/xrdp.ini and modify the security_layer setting

[Globals]
; Force TLS security layer to mitigate MAC verification bypass
security_layer=tls

# Restart xrdp service after configuration change
sudo systemctl restart xrdp