What is the CVSS score of CVE-2026-54538?

CVE-2026-54538 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.7%.

Which versions of Xrdp are affected by CVE-2026-54538?

An unauthenticated remote denial-of-service vulnerability in xrdp allows attackers to trigger infinite loops that exhaust CPU resources and crash the RDP service without requiring credentials.. A patch is available.

How to fix or mitigate CVE-2026-54538?

Within 24 hours, conduct a complete inventory of all systems running xrdp versions before v0.10.6.1 and assess network exposure of RDP listeners to identify production systems requiring immediate patching; document affected versions and plan maintenance windows to minimize service disruption. Within 7 days, upgrade all xrdp installations to v0.10.6.1 or later across all environments starting with production and critical infrastructure; test the patched version in a staging environment to validate compatibility and functionality before rolling out to production. Within 30 days, complete the upgrade across all remaining systems, verify successful patching through service health checks and version confirmation, and implement continuous monitoring for abnormal CPU utilization or connection patterns that might indicate exploitation attempts.

Xrdp CVE-2026-54538

EUVD-2026-46032 HIGH

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2026-07-09 vendor:ubuntu

Denial Of Service Xrdp Suse Neutrinolabs

7.5

CVSS 3.1 · Vendor: vendor:ubuntu

Severity by source

Vendor (vendor:ubuntu) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

HIGH

qualitative

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 20, 2026 - 18:18 EUVD

Source Code Evidence Fetched

Jul 20, 2026 - 17:34 vuln.today

Analysis Updated

Jul 20, 2026 - 17:34 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 20, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

Jul 20, 2026 - 17:22 NVD

7.5 (HIGH)

Analysis Generated

Jul 09, 2026 - 19:12 vuln.today

DescriptionCVE.org

[Unknown description]

AnalysisAI

Remote denial of service in xrdp (the open-source Microsoft RDP server from neutrinolabs) before v0.10.6.1 allows unauthenticated remote attackers to trigger an infinite loop (CWE-835) that exhausts CPU and hangs the service. No exploit code has been publicly identified and the flaw is not in CISA KEV, but the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only) reflects that it is reachable pre-authentication over the network against default RDP listeners. It was fixed alongside nine other vulnerabilities in the coordinated v0.10.6.1 release published 2026-07-06.

More in Xrdp

View all

CVE-2026-41252 CRITICAL Act Now

9.8 Jul 09

Remote unauthenticated heap buffer overflow in xrdp (the open-source Remote Desktop Protocol server from neutrinolabs) a

CVE-2013-1430 CRITICAL Act Now

9.8 Dec 16

An issue was discovered in xrdp before 0.9.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploit

CVE-2024-39917 CRITICAL Act Now

9.8 Jul 12

xrdp is an open source RDP server. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no au

CVE-2022-23484 CRITICAL Act Now

9.8 Dec 09