CVE-2026-55645 Overview
CVE-2026-55645 is an out-of-bounds read vulnerability [CWE-125] in xrdp, an open source Remote Desktop Protocol (RDP) server maintained by neutrinolabs. The flaw affects xrdp versions 0.10.6 and prior. The parser fails to perform sufficient length validation before reading data fields from Client Control Protocol Data Units (PDUs) during the RDP connection sequence. A remote, unauthenticated attacker can send a specially crafted, truncated Client Control PDU to trigger out-of-bounds memory reads. The result is a crash of the connection-handling xrdp process, producing a limited denial of service condition. The issue is fixed in version 0.10.6.1.
Critical Impact
A remote, unauthenticated attacker can crash individual xrdp worker processes and potentially leak small amounts of adjacent process memory through malformed RDP handshake traffic.
Affected Products
- neutrinolabs xrdp versions 0.10.6 and prior
- Linux and Unix distributions packaging vulnerable xrdp builds
- RDP-exposed hosts using xrdp for remote desktop access
Discovery Timeline
- 2026-07-20 - CVE-2026-55645 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-55645
Vulnerability Analysis
The vulnerability resides in xrdp's handling of Client Control PDUs during the RDP connection sequence. Client Control PDUs are part of the RDP connection-establishment phase and carry small control messages that the server parses before a session is fully negotiated. The xrdp parser reads specific fields directly from the network stream without confirming that the received PDU contains enough bytes to satisfy those reads.
When an attacker submits a truncated PDU, the parser advances past the end of the buffer and dereferences memory outside the intended bounds. The affected xrdp process typically crashes when the read touches an unmapped page. Because xrdp forks a dedicated worker process for each incoming connection by default, a crash terminates only that worker rather than the parent listener. The service therefore continues accepting new connections, which limits the practical availability impact.
Root Cause
The root cause is missing bounds checking [CWE-125] before reading fields from an attacker-controlled network buffer. The parser trusts implicit length assumptions in the PDU structure rather than validating the remaining buffer length against the size required to satisfy each field read.
Attack Vector
Exploitation requires network reachability to the xrdp listener, typically TCP port 3389. No authentication or user interaction is required because the flaw is triggered during the pre-authentication connection sequence. An attacker crafts an RDP session that reaches the Client Control PDU stage and sends a PDU whose declared or expected structure exceeds the actual bytes provided.
The vulnerability does not allow code execution. Impact is limited to process termination and potential disclosure of small regions of adjacent heap or stack memory to the attacker-controlled session, depending on how the out-of-bounds bytes are subsequently used by xrdp.
Detection Methods for CVE-2026-55645
Indicators of Compromise
- Repeated xrdp worker process crashes recorded in system logs such as /var/log/xrdp.log or journalctl -u xrdp
- Segmentation fault entries referencing xrdp in dmesg or the kernel audit log
- Short-lived RDP connections from unfamiliar source IPs that terminate before session negotiation completes
Detection Strategies
- Monitor for abnormal rates of xrdp child process exits with non-zero status codes
- Inspect network telemetry for malformed or truncated RDP PDUs targeting TCP port 3389
- Correlate RDP handshake failures with source IPs to identify probing or scripted abuse
Monitoring Recommendations
- Enable verbose xrdp logging to capture PDU parsing errors during the connection sequence
- Forward xrdp and system crash logs to a centralized log platform for correlation and alerting
- Track the installed xrdp package version across Linux fleets to confirm all hosts run 0.10.6.1 or later
How to Mitigate CVE-2026-55645
Immediate Actions Required
- Upgrade xrdp to version 0.10.6.1 or later on all affected hosts
- Restrict inbound access to TCP port 3389 using host or network firewalls, allowing only trusted sources
- Place xrdp behind a VPN or bastion host to remove direct internet exposure
Patch Information
The maintainers released the fix in xrdp 0.10.6.1. The patched release adds proper length validation before reading Client Control PDU fields. Review the GitHub Release Notes and the GitHub Security Advisory GHSA-3m4m-h22g-c7xx for full details. Rebuild any custom xrdp packages against the fixed source and redeploy to managed hosts.
Workarounds
- Block TCP port 3389 at the network perimeter and require VPN access for remote desktop sessions
- Apply source IP allowlists in iptables or nftables to limit which hosts can reach the xrdp listener
- Disable xrdp on systems that do not require RDP access until the patched version is deployed
# Configuration example
# Restrict xrdp to trusted management subnet using nftables
nft add rule inet filter input tcp dport 3389 ip saddr != 10.0.0.0/24 drop
# Confirm installed xrdp version after upgrade
xrdp --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
