CVE-2026-54538

{
  "id": "CVE-2026-54538",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-20T17:17:59.723",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the software fails to properly validate the totalLength field within the RDP protocol control header during packet reception. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted packet that forces the xrdp process or thread into an infinite, CPU-bound loop. Because the internal pointer fails to advance and the deadlock prevention mechanism is bypassed for specific protocol data unit types, the process consumes excessive CPU resources indefinitely. This can render the xrdp service unavailable and potentially lead to system-wide resource exhaustion if multiple malicious connections are established. This issue has been fixed in version 0.10.6.1."
    },
    {
      "lang": "es",
      "value": "xrdp es un servidor RDP de código abierto. En las versiones 0.10.6 y anteriores, se descubrió un problema donde el software no valida correctamente el campo totalLength dentro del encabezado de control del protocolo RDP durante la recepción de paquetes. Un atacante remoto no autenticado puede explotar esta vulnerabilidad enviando un paquete especialmente diseñado que fuerza al proceso o hilo de xrdp a un bucle infinito que consume CPU. Debido a que el puntero interno no avanza y el mecanismo de prevención de interbloqueos se omite para tipos específicos de unidades de datos de protocolo, el proceso consume recursos excesivos de CPU indefinidamente. Esto puede dejar el servicio xrdp no disponible y potencialmente conducir al agotamiento de recursos en todo el sistema si se establecen múltiples conexiones maliciosas. Este problema ha sido solucionado en la versión 0.10.6.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "neutrinolabs",
          "product": "xrdp",
          "versions": [
            {
              "version": "< 0.10.6.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-20T18:47:49.766693Z",
          "id": "CVE-2026-54538",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:neutrinolabs:xrdp:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "0.10.6.1",
              "matchCriteriaId": "A994DC5A-6181-45D2-A489-0E409B19A0FE"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-9j3q-9mvw-qv7j",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}