CVE-2026-55645

{
  "id": "CVE-2026-55645",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-20T17:18:07.430",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of Client Control PDUs. During the RDP connection sequence, the parser does not perform sufficient length validation before reading specific data fields from the network stream. A remote, unauthenticated attacker could potentially exploit this flaw by sending a specially crafted, truncated Client Control PDU. Due to missing bounds checks, the xrdp process may perform out-of-bounds memory reads, which can result in the termination of the service (Denial of Service). However, since xrdp forks a new process for each connection by default, an out-of-bounds read causing a process crash is unlikely to bring down the entire xrdp service.This issue has been fixed in version 0.10.6.1."
    },
    {
      "lang": "es",
      "value": "xrdp es un servidor RDP de código abierto. Las versiones 0.10.6 y anteriores contienen una vulnerabilidad concerniente al procesamiento de PDUs de Control de Cliente. Durante la secuencia de conexión RDP, el analizador no realiza una validación de longitud suficiente antes de leer campos de datos específicos del flujo de red. Un atacante remoto y no autenticado podría potencialmente explotar esta falla enviando una PDU de Control de Cliente truncada y especialmente diseñada. Debido a la falta de comprobaciones de límites, el proceso xrdp puede realizar lecturas de memoria fuera de límites, lo que puede resultar en la terminación del servicio (Denegación de Servicio). Sin embargo, dado que xrdp bifurca un nuevo proceso para cada conexión por defecto, es poco probable que una lectura fuera de límites que cause un fallo del proceso derribe todo el servicio xrdp. Este problema ha sido solucionado en la versión 0.10.6.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "neutrinolabs",
          "product": "xrdp",
          "versions": [
            {
              "version": "< 0.10.6.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-21T15:23:55.354517Z",
          "id": "CVE-2026-55645",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:neutrinolabs:xrdp:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "0.10.6.1",
              "matchCriteriaId": "A994DC5A-6181-45D2-A489-0E409B19A0FE"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-3m4m-h22g-c7xx",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}