Suse CVE-2026-32624

xrdp is an open-source RDP (Remote Desktop Protocol) server that implements the Microsoft RDP protocol for remote desktop connectivity on Unix-like systems. The vulnerability exists in the logon processing code path, specifically in how xrdp parses and validates username and domain name inputs during RDP session authentication. The domain_user_separator configuration directive allows xrdp to split incoming credentials into separate domain and username components using a specified delimiter. The heap-based buffer overflow (CWE-122) occurs when the combined length of the domain and username components exceeds the pre-allocated buffer size in memory, causing a write beyond the buffer boundary. This corrupts adjacent heap-allocated structures, potentially including metadata or other sensitive data used by the RDP server process. The vulnerability is in the unauthenticated portion of the RDP handshake, meaning an attacker does not need valid credentials to trigger the overflow.