What’s Vulnerable › Products
neutrinolabs xrdp vulnerabilities
37 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 19 published in the last 12 months.
Check whether your neutrinolabs xrdp version is affected
Latest neutrinolabs xrdp vulnerabilities
- CVE-2026-55639 — xrdp: Out-of-bounds read in GCC Conference Create Request CS_SECURITY processing (xrdp_sec_process_mcs_data_CS_SECURITY) (CVSS 5.3)
- CVE-2026-55626 — xrdp: No authentication required with Xvnc backend on RHEL 9 (CVSS 7.3)
- CVE-2026-55645 — xrdp: Out-of-bounds read in Client Control PDU processing (xrdp_rdp_process_data_control) (CVSS 6.5)
- CVE-2026-55238 — xrdp: Malformed Confirm Active capability sets cause out-of-bounds reads (CVSS 5.3)
- CVE-2026-54538 — xrdp: Pre-auth infinite loop via totalLength=0 in TS_SHARECONTROLHEADER (CVSS 7.5)
- CVE-2026-44978 — xrdp: Unchecked FIPS padding length in standard RDP Security causes heap out-of-bounds read in HMAC verification (CVSS 5.3)
- CVE-2026-44178 — xrdp: Channel Data Forwarding Fixed-Size Buffer Overflow (CVSS 8.8)
- CVE-2026-42218 — XRDP is vulnerable to a server timing attack, leading to user enumeration (CVSS 5.3)
- CVE-2026-41521 — xrdp: lib_framebuffer_update Has Integer Overflow Heap Info Leak & ASLR Bypass (CVSS 9.1)
- CVE-2026-41252 — xrdp: lib_palette_update Heap Buffer Overflow & RCE (CVSS 9.8)
- CVE-2026-35512 — xrdp: Heap buffer overflow in EGFX channel (CVSS 8.8)
- CVE-2026-33689 — xrdp: Pre-authentication out-of-bounds reads in channel parsers (CVSS 9.1)
- CVE-2026-33145 — xrdp: Authenticated RCE via unsanitized AlternateShell execution in xrdp-sesman (CVSS 6.3)
- CVE-2026-33516 — xrdp: Pre-authentication out-of-bounds reads in RDP capability and channel parsers (CVSS 9.1)
- CVE-2026-32624 — xrdp: Heap buffer overflow in xrdp_sec_process_logon_info() via incorrect g_strncat length calculation (CVSS 6.5)
- CVE-2026-32623 — xrdp: Heap buffer overflow in NeutrinoRDP channel reassembly (CVSS 8.1)
- CVE-2026-32107 — xrdp: Fail-open privilege drop in sesexec — child processes may execute as root if setuid fails (CVSS 8.8)
- CVE-2026-32105 — xrdp: RDP MAC signature (dataSignature) never verified on receive — integrity bypass in non-TLS mode (CVSS 7.7)
- CVE-2025-68670 — xrdp improperly checks bounds of domain string length, which leads to Stack-based Buffer Overflow (CVSS 9.8)
- CVE-2024-39917 — xrdp allows an ininite number of login attempts (CVSS 9.8)
- CVE-2023-42822 — Unchecked access to font glyph info in xrdp (CVSS 6.5)
- CVE-2023-40184 — Improper handling of session establishment errors in xrdp (CVSS 6.5)
- CVE-2022-23493 — Out of Bound Read in xrdp (CVSS 9.1)
- CVE-2022-23484 — Integer Overflow in xrdp (CVSS 9.8)
- CVE-2022-23483 — Out-of-Bound Read in libxrdp (CVSS 9.1)