Skip to main content

Xrdp CVE-2026-32105

| EUVDEUVD-2026-23472 CRITICAL
Improper Validation of Integrity Check Value (CWE-354)
2026-04-17 GitHub_M
Information Disclosure Xrdp Suse Neutrinolabs
Critical
Disputed · 9.3 NVD
Share

Severity by source

Sources disagree (Medium–Critical)
GitHub Advisory PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
7.7 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Red Hat
5.9 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

7
Patch released
Apr 27, 2026 - 14:20 nvd
Patch available
Re-analysis Queued
Apr 20, 2026 - 19:07 vuln.today
cvss_changed
Analysis Generated
Apr 17, 2026 - 22:09 vuln.today
Patch available
Apr 17, 2026 - 20:16 EUVD
EUVD ID Assigned
Apr 17, 2026 - 19:45 euvd
EUVD-2026-23472
Analysis Generated
Apr 17, 2026 - 19:45 vuln.today
CVE Published
Apr 17, 2026 - 19:27 nvd
CRITICAL 9.3

DescriptionGitHub Advisory

xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement verification for the Message Authentication Code (MAC) signature of encrypted RDP packets when using the "Classic RDP Security" layer. While the sender correctly generates signatures, the receiving logic lacks the necessary implementation to validate the 8-byte integrity signature, causing it to be silently ignored. An unauthenticated attacker with man-in-the-middle (MITM) capabilities can exploit this missing check to modify encrypted traffic in transit without detection. It does not affect connections where the TLS security layer is enforced. This issue has been fixed in version 0.10.6. If users are unable to immediately upgrade, they should configure xrdp.ini to enforce TLS security (security_layer=tls) to ensure end-to-end integrity.

AnalysisAI

Missing MAC signature verification in xrdp 0.10.5 and earlier allows man-in-the-middle attackers to modify encrypted RDP traffic without detection when Classic RDP Security layer is used. Unauthenticated network attackers with MITM position can alter packet contents in transit, achieving high integrity and confidentiality impact on both vulnerable and subsequent systems (CVSS 9.3, CVSS:4.0 with scope change). TLS security layer deployments are not affected. Vendor patch released in version 0.10.6. No active exploitation or public POC identified at time of analysis, but EPSS data unavailable for risk assessment.

Technical ContextAI

xrdp is an open-source Remote Desktop Protocol server implementation allowing graphical remote access to Linux systems. The vulnerability affects the Classic RDP Security layer, a legacy encryption mechanism predating TLS-based RDP security. Classic RDP Security uses RC4 stream cipher with salted MAC-based integrity protection, where each encrypted packet includes an 8-byte HMAC signature. The flaw (CWE-354: Improper Validation of Integrity Check Value) exists in xrdp's receiving logic - while the sender correctly computes and appends the MAC signature, the receiver performs no cryptographic verification of this integrity tag. This creates a cryptographic oracle where attackers can modify ciphertext without triggering integrity failures. The vulnerability specifically targets the xrdp server component in all versions through 0.10.5, affecting deployments that permit or default to Classic RDP Security negotiation rather than enforcing modern TLS-based security layers.

RemediationAI

Primary fix: Upgrade to xrdp version 0.10.6 or later, which implements proper MAC signature verification for Classic RDP Security packets. Download from https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6 and follow standard package upgrade procedures for your distribution. For environments unable to immediately upgrade, implement the vendor-recommended workaround by editing /etc/xrdp/xrdp.ini and setting 'security_layer=tls' in the global configuration section, then restart the xrdp service. This enforces TLS-based RDP security, completely bypassing the vulnerable Classic RDP Security code path. Trade-off: TLS enforcement may break compatibility with extremely legacy RDP clients (pre-Windows XP SP3 era), but such clients are themselves critically insecure and should not be in production use. Network-layer compensating control: Deploy network intrusion detection systems with RDP protocol inspection capabilities to detect anomalous packet patterns indicative of MITM manipulation, though this provides detection rather than prevention. Advisory reference: https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-j2jm-c596-c5q3 contains complete vendor guidance.

More in Xrdp

View all
CVE-2026-41252 CRITICAL
9.8 Jul 09

Remote unauthenticated heap buffer overflow in xrdp (the open-source Remote Desktop Protocol server from neutrinolabs) a
CVE-2013-1430 CRITICAL
9.8 Dec 16

An issue was discovered in xrdp before 0.9.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploit
CVE-2024-39917 CRITICAL
9.8 Jul 12

xrdp is an open source RDP server. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no au
CVE-2022-23484 CRITICAL
9.8 Dec 09

xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protoc
CVE-2022-23480 CRITICAL
9.8 Dec 09

xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protoc
CVE-2022-23479 CRITICAL
9.8 Dec 09

xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protoc
CVE-2022-23478 CRITICAL
9.8 Dec 09

xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protoc
CVE-2022-23477 CRITICAL
9.8 Dec 09

xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protoc
CVE-2022-23468 CRITICAL
9.8 Dec 09

xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protoc
CVE-2026-41521 CRITICAL
9.1 Jul 09

Information disclosure in xrdp (neutrinolabs open-source RDP server) before version 0.10.6.1 stems from an integer overf
CVE-2025-68670 CRITICAL
9.1 Jan 27

xrdp open-source RDP server before v0.10.5 has an unauthenticated stack buffer overflow enabling remote code execution.
CVE-2022-23493 CRITICAL
9.1 Dec 09

xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protoc

Same weakness CWE-354 – Improper Validation of Integrity Check Value

View all
CVE-2023-48795 MEDIUM POC
5.9
CVE-2024-3596 CRITICAL
9.0
CVE-2023-33668 CRITICAL POC
9.8
CVE-2026-50021 HIGH POC
8.1
CVE-2022-36174 HIGH POC
8.1
CVE-2019-13496 HIGH POC
8.1
CVE-2024-51141 HIGH POC
7.8
CVE-2023-38802 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

Share

CVE-2026-32105 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy