CVE-2026-55645

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.10.6.1

Description An issue exists in the processing of Client Control PDUs (Protocol Data Units) during the RDP connection sequence. The parser fails to perform sufficient length validation before reading specific data fields from the network stream. A remote, unauthenticated attacker can exploit this by sending a specially crafted, truncated Client Control PDU, leading to out-of-bounds memory reads. This can result in a Denial of Service (DoS) by terminating the process. Because the software typically forks a new process for each connection, a crash is unlikely to affect the entire service.

Recommendations Update to version 0.10.6.1.