CVE-2026-55639

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.10.6.1

Description An issue exists in the parsing of Client Security Data within the Client MCS Connect Initial PDU with GCC Conference Create Request during the connection sequence. During the initial capability and security negotiation phase, the parser fails to perform sufficient length validation for the incoming data block. A remote, unauthenticated attacker could exploit this by sending a specially crafted RDP packet containing malformed data. Due to missing bounds checks, the process may read bytes beyond the declared data block boundary, potentially disclosing process memory contents.

Recommendations Update to version 0.10.6.1.