CVE-2026-41521

{
  "id": "CVE-2026-41521",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-20T17:17:08.460",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update messages within the vnc-any connection mode. A malicious remote VNC server can send crafted image dimensions that cause an integer overflow during memory buffer size calculation, resulting in an undersized allocation. Subsequent processing of the incoming image data using the original oversized parameters leads to an out-of-bounds read. An unauthenticated remote attacker could exploit this flaw to disclose sensitive information from the heap memory or cause a denial of service (DoS) via a process crash. This issue has been fixed in version 0.10.6.1."
    },
    {
      "lang": "es",
      "value": "xrdp es un servidor RDP de código abierto. Las versiones 0.10.6 y anteriores contienen una vulnerabilidad de desbordamiento de entero al procesar mensajes de actualización de pantalla dentro del modo de conexión vnc-any. Un servidor VNC remoto malicioso puede enviar dimensiones de imagen manipuladas que causan un desbordamiento de entero durante el cálculo del tamaño del búfer de memoria, lo que resulta en una asignación de tamaño insuficiente. El procesamiento posterior de los datos de imagen entrantes utilizando los parámetros originales de tamaño excesivo conduce a una lectura fuera de límites. Un atacante remoto no autenticado podría explotar esta falla para divulgar información sensible de la memoria heap o causar una denegación de servicio (DoS) a través de un fallo del proceso. Este problema ha sido corregido en la versión 0.10.6.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "neutrinolabs",
          "product": "xrdp",
          "versions": [
            {
              "version": "< 0.10.6.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-20T18:57:06.302836Z",
          "id": "CVE-2026-41521",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:neutrinolabs:xrdp:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "0.10.6.1",
              "matchCriteriaId": "A994DC5A-6181-45D2-A489-0E409B19A0FE"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-v8w6-pf78-9458",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}