Buffer overflow in Neutrinolabs Xrdp
CVE-2026-32624
xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow vulnerability in its logon processing. In environments where domain_user_separator is configured in xrdp.ini, an unauthenticated remote attacker can send a crafted, excessively long username and domain name to overflow the internal buffer. This can corrupt adjacent memory regions, potentially leading to a Denial of Service (DoS) or unexpected behavior. The domain_name_separator directive is commented out by default, systems are not affected by this vulnerability unless it is intentionally configured. This issue has been fixed in version 0.10.6.
Vulnerability class: Buffer Overflow
EPSS: 0.004 (33.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.
Affected products
- Neutrinolabs Xrdp — versions < 0.10.6
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2026-32624?
- CVE-2026-32624 is a medium-severity vulnerability in Neutrinolabs Xrdp, classified under Heap-based Buffer Overflow. CVSS score: 6.5/10. Published 2026-04-17.
- How severe is CVE-2026-32624?
- Medium severity. CVSS v3 base score is 6.5 out of 10.