CVE-2026-55639 Overview
CVE-2026-55639 is an out-of-bounds read vulnerability [CWE-125] in xrdp, an open source Remote Desktop Protocol (RDP) server. The flaw affects versions 0.10.6 and prior. It resides in the parser that handles Client Security Data inside the Client Multipoint Communication Service (MCS) Connect Initial PDU with a Generic Conference Control (GCC) Conference Create Request. The parser fails to perform sufficient length validation on the incoming data block. A remote, unauthenticated attacker can send a specially crafted RDP packet to trigger the read past the declared boundary. The maintainers fixed the issue in version 0.10.6.1.
Critical Impact
A remote, unauthenticated attacker can leak a small amount of xrdp process memory over the network, which can be chained with other vulnerabilities to escalate impact.
Affected Products
- xrdp versions 0.10.6 and prior
- Linux and Unix systems running vulnerable xrdp packages exposed via RDP (TCP/3389)
- Fixed in xrdp version 0.10.6.1
Discovery Timeline
- 2026-07-20 - CVE-2026-55639 published to the National Vulnerability Database
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2026-55639
Vulnerability Analysis
The vulnerability occurs during the initial RDP capability and security negotiation phase. When an xrdp server receives a Client MCS Connect Initial PDU carrying a GCC Conference Create Request, the server parses embedded data blocks, including Client Security Data. The parser trusts a length field associated with the incoming data block without cross-checking it against the actual remaining bytes in the buffer. As a result, subsequent read operations reference memory beyond the declared boundary of the data block. Because the read is small and does not corrupt memory, the primary consequence is information disclosure rather than crash or code execution. The disclosed bytes originate from adjacent process memory in the xrdp server process.
Root Cause
The root cause is missing bounds validation on user-controlled length values in the MCS/GCC parsing path. The parser advances read pointers based on client-supplied metadata without enforcing that the referenced offsets remain within the declared data block. This pattern is a classic out-of-bounds read [CWE-125], where the attacker controls the length or offset used to index into a buffer.
Attack Vector
The attack requires only network reachability to the RDP listener. No authentication or user interaction is needed. An attacker crafts an RDP session initiation that includes a malformed GCC Conference Create Request with a Client Security Data block whose length field is inconsistent with the actual data present. When the xrdp parser processes this block, it reads a small number of bytes beyond the boundary. The attacker can then observe response data or side effects to infer leaked memory. Repeated connections can be used to sample additional memory content over time. See the GitHub Security Advisory GHSA-6g36-mxcf-r3gc for technical details.
Detection Methods for CVE-2026-55639
Indicators of Compromise
- Unusual volume of short-lived RDP connections from a single source to TCP/3389 that terminate during the MCS Connect Initial phase.
- xrdp log entries showing malformed GCC Conference Create Requests or truncated Client Security Data blocks.
- Repeated RDP session initialization attempts that never progress to authentication.
Detection Strategies
- Inspect RDP traffic at the network layer for MCS Connect Initial PDUs with inconsistent GCC data block length fields.
- Correlate xrdp process telemetry with network flow data to identify sources probing the pre-authentication parser.
- Alert on xrdp binaries running versions at or below 0.10.6 discovered by asset inventory or software composition scans.
Monitoring Recommendations
- Enable verbose xrdp logging during the negotiation phase and forward logs to a centralized SIEM for parsing anomalies.
- Monitor for scanning behavior against port 3389 originating from untrusted networks.
- Track EDR telemetry on Linux hosts running xrdp for unexpected process behavior or repeated crash-free short connections.
How to Mitigate CVE-2026-55639
Immediate Actions Required
- Upgrade xrdp to version 0.10.6.1 or later on all affected hosts.
- Restrict RDP exposure by limiting inbound TCP/3389 access to trusted management networks or VPN users only.
- Audit Linux and Unix systems for the presence of xrdp and confirm running versions.
Patch Information
The xrdp maintainers released a fix in version 0.10.6.1. Refer to the GitHub Release v0.10.6.1 and the GitHub Security Advisory GHSA-6g36-mxcf-r3gc for release notes and the patch commit. Package maintainers for major Linux distributions typically ship the fixed version through standard update channels.
Workarounds
- Block or firewall TCP/3389 at the network perimeter where RDP is not required.
- Place xrdp behind a VPN or bastion host that terminates untrusted client connections before they reach the vulnerable parser.
- Disable the xrdp service on hosts where remote graphical access is not needed.
# Configuration example: verify installed xrdp version and restrict access
xrdp --version
# Debian/Ubuntu upgrade
sudo apt update && sudo apt install --only-upgrade xrdp
# Restrict RDP to a trusted management subnet using iptables
sudo iptables -A INPUT -p tcp --dport 3389 -s 10.10.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 3389 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
