CVE-2026-35512: xrdp RCE Vulnerability

CVE-2026-35512 Overview

CVE-2026-35512 is a heap-based buffer overflow vulnerability affecting xrdp, an open source Remote Desktop Protocol (RDP) server. The vulnerability exists in the EGFX (Enhanced Graphics) dynamic virtual channel implementation due to insufficient validation of client-controlled size parameters. This flaw allows attackers to perform an out-of-bounds write via specially crafted Protocol Data Units (PDUs), potentially leading to denial of service or remote code execution.

Critical Impact

Pre-authentication exploitation can crash the xrdp process causing service disruption, while post-authentication exploitation may achieve remote code execution on vulnerable systems.

Affected Products

• xrdp versions through 0.10.5
• All systems running vulnerable xrdp EGFX implementations
• Linux/Unix servers with xrdp configured for remote desktop access

Discovery Timeline

• April 17, 2026 - CVE-2026-35512 published to NVD
• April 20, 2026 - Last updated in NVD database

Technical Details for CVE-2026-35512

Vulnerability Analysis

This vulnerability is classified as CWE-122 (Heap-based Buffer Overflow). The flaw resides in xrdp's EGFX implementation, which is responsible for handling enhanced graphics rendering over the RDP protocol. When processing incoming PDUs from RDP clients, the server fails to properly validate size parameters that are controlled by the client. This insufficient bounds checking allows an attacker to specify malicious size values that cause the server to write data beyond the allocated heap buffer boundaries.

The network-accessible nature of this vulnerability is particularly concerning for organizations using xrdp for remote access. An attacker with network access to the RDP service can craft malicious PDUs to trigger the overflow condition. The exploitation outcome differs based on authentication state: unauthenticated attackers can reliably crash the xrdp process, while authenticated attackers have greater control over the heap corruption and may achieve code execution.

Root Cause

The root cause is insufficient validation of client-controlled size parameters in the EGFX dynamic virtual channel handler. The xrdp server trusts size values provided in incoming PDUs without verifying they fall within acceptable bounds for the allocated buffer. This allows attackers to specify oversized values that result in heap memory corruption when the server attempts to process the malicious data.

Attack Vector

The attack is network-based and targets the RDP service listening on the network. An attacker crafts malicious EGFX PDUs containing invalid size parameters and sends them to the vulnerable xrdp server. The server's failure to validate these parameters before memory operations results in an out-of-bounds write condition.

For pre-authentication attacks, the corrupted heap state leads to process termination, causing denial of service. Post-authentication exploitation requires more sophisticated heap manipulation but can potentially achieve arbitrary code execution by controlling the overflow to overwrite critical heap metadata or function pointers.

Technical details regarding the specific vulnerable code paths and exploitation techniques can be found in the GitHub Security Advisory GHSA-jg6p-7fg8-9hh6.

Detection Methods for CVE-2026-35512

Indicators of Compromise

• Unexpected xrdp process crashes or restarts on systems exposed to untrusted networks
• Abnormal memory allocation patterns in xrdp process logs
• Malformed RDP EGFX channel traffic with anomalous size parameters
• Core dumps from xrdp showing heap corruption signatures

Detection Strategies

• Deploy network intrusion detection signatures to identify malformed EGFX PDUs targeting xrdp
• Monitor xrdp service for unexpected terminations or restart patterns
• Implement application-level logging to capture anomalous RDP session behavior
• Use memory protection tools to detect heap corruption attempts in real-time

Monitoring Recommendations

• Enable verbose logging for xrdp services to capture connection anomalies
• Monitor network traffic for unusual RDP protocol patterns targeting EGFX channels
• Set up alerting for xrdp process crashes or abnormal resource consumption
• Review authentication logs for suspicious RDP connection attempts preceding crashes

How to Mitigate CVE-2026-35512

Immediate Actions Required

• Upgrade xrdp to version 0.10.6 or later which contains the security fix
• If immediate patching is not possible, ensure xrdp runs as a non-privileged user (default since 0.10.2)
• Restrict network access to xrdp services using firewall rules
• Consider implementing network segmentation to limit exposure of RDP services

Patch Information

The vulnerability has been fixed in xrdp version 0.10.6. Organizations should update to this version immediately. The fix implements proper bounds checking for client-supplied size parameters in the EGFX implementation, preventing the out-of-bounds write condition.

Patch details and release notes are available at the GitHub Release v0.10.6.

Workarounds

• Run xrdp as a non-privileged user to limit the impact of successful exploitation (this is the default configuration since version 0.10.2)
• Implement strict firewall rules to allow RDP connections only from trusted IP addresses
• Deploy a VPN or jump host architecture to prevent direct internet exposure of xrdp services
• Consider disabling EGFX channel if enhanced graphics features are not required (may impact performance)

# Configuration example
# Ensure xrdp runs as non-privileged user
# Check current xrdp user in /etc/xrdp/sesman.ini
grep -i "user" /etc/xrdp/sesman.ini

# Restrict xrdp access via iptables (example)
iptables -A INPUT -p tcp --dport 3389 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 3389 -j DROP

# Restart xrdp service after configuration changes
systemctl restart xrdp