CVE-2026-41252

{
  "id": "CVE-2026-41252",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-20T17:17:08.310",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp, which allows a heap-based buffer overflow when operating in vnc-any mode. The issue occurs during the handling of RFB protocol color map messages from a VNC server, where incoming color indices are not properly validated. A malicious VNC server can exploit this flaw by sending crafted messages with out-of-range values, leading to an out-of-bounds write on the heap. This memory corruption can result in a denial of service (DoS) or potentially allow remote code execution (RCE) prior to authentication. This issue has been fixed in version 0.10.6.1."
    },
    {
      "lang": "es",
      "value": "xrdp es un servidor RDP de código abierto. Las versiones 0.10.6 y anteriores contienen una falta de verificación de límites en xrdp, lo que permite un desbordamiento de búfer basado en montículo al operar en modo vnc-any. El problema ocurre durante el manejo de mensajes de mapa de colores del protocolo RFB de un servidor VNC, donde los índices de color entrantes no se validan correctamente. Un servidor VNC malicioso puede explotar esta falla enviando mensajes manipulados con valores fuera de rango, lo que lleva a una escritura fuera de límites en el montículo. Esta corrupción de memoria puede resultar en una denegación de servicio (DoS) o potencialmente permitir la ejecución remota de código (RCE) antes de la autenticación. Este problema ha sido corregido en la versión 0.10.6.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "neutrinolabs",
          "product": "xrdp",
          "versions": [
            {
              "version": "< 0.10.6.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T00:00:00+00:00",
          "id": "CVE-2026-41252",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:neutrinolabs:xrdp:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "0.10.6.1",
              "matchCriteriaId": "A994DC5A-6181-45D2-A489-0E409B19A0FE"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-w5vg-6qmv-j63j",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}