External risk intelligence

xrdp vnc-any Heap Overflow Leads to Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-41252

The vulnerability affects xrdp in vnc-any mode. Exploitation requires the xrdp server to act as a client connecting to a malicious VNC server, rather than the primary RDP listener. Since this requires a non-standard configuration where xrdp initiates a connection to an attacker-controlled VNC server, public exposure is less common than standard RDP services.

Remote Code Execution

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in xrdp, a type of remote desktop software, which could allow an unauthenticated attacker to potentially execute code remotely or cause a denial of service. This flaw is related to how the software handles specific messages when configured in a less common "vnc-any" mode. The main concern is confirming if this specific configuration is in use and if it is exposed externally.

Flaw in remote desktop software's message handling.
Matters if using xrdp in a specific, less common mode.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could target an xrdp server operating in "vnc-any" mode. This mode is unusual because the xrdp server acts as a client to a VNC server. By controlling a VNC server, an attacker could send specially crafted color map messages to the xrdp client. If these messages contain out-of-range values, they could trigger a heap-based buffer overflow, potentially leading to remote code execution or a denial of service before any user authentication.

Requires xrdp acting as a VNC client.
Crafted VNC color map messages trigger overflow.
Risk of denial of service or code execution.

Live Threat

Current exploitation, exposure, and threat context

In vnc-any mode, an unauthenticated attacker controlling a VNC server could cause a heap-based buffer overflow by sending crafted color map messages. This memory corruption could lead to a denial of service or, when supported by the advisory, remote code execution.

Server memory could be corrupted.
Crafted VNC messages could be sent.
Denial of service or remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership likely falls to infrastructure or platform teams managing the xrdp service, with input from security teams for exposure assessment and vendor management if the VNC component is sourced externally. The initial step involves identifying all xrdp deployments, particularly those configured for vnc-any mode, assessing their reachability and business criticality, and then engaging the accountable owner to prioritize remediation.

Infrastructure or platform teams own this.
Verify xrdp vnc-any mode reachability.
Plan and coordinate upgrade or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is xrdp and how is it used?

xrdp is an open-source tool that provides a remote desktop experience, allowing users to access graphical interfaces over a network. It functions primarily as an RDP server, enabling systems to accept connections from RDP clients. In specific, less common setups, it can also operate in 'vnc-any' mode, where it acts as a client that connects to a VNC server to bridge communication between different desktop protocols.

What does CWE-122 mean for CVE-2026-41252?

CWE-122 refers to a heap-based buffer overflow. In the context of CVE-2026-41252, this means the software fails to properly check the size of data it receives when processing color map messages from a VNC server. Because this data is written to a specific area of memory called the heap without proper validation, an attacker can overwrite adjacent memory, which may lead to system crashes or the unauthorized execution of arbitrary code.

Do I need to be using vnc-any mode for this to be a risk?

Yes. This vulnerability is specifically triggered by how xrdp processes messages while operating in 'vnc-any' mode. If your xrdp instance is configured for standard RDP connections and is not set up to act as a client connecting to a VNC server, this specific memory corruption path is not triggered. The bug requires the software to be performing the role of a client receiving crafted, out-of-range color index data from a VNC source.

How do I evaluate my exposure to this xrdp flaw?

According to Halo Surface Signal, this vulnerability is classified as 'Possible' rather than highly likely because it depends on a non-standard configuration. Focus your assessment on identifying instances where xrdp is configured to connect to VNC servers. Since the exploit requires the xrdp server to initiate a connection to an attacker-controlled VNC server, it is less exposed than a standard, internet-facing RDP listener.

How should I respond if I am running affected xrdp versions?

Your first step is to conduct an inventory to locate all xrdp deployments and verify which are running in 'vnc-any' mode. Once identified, prioritize these instances for updates, as the issue is resolved in version 0.10.6.1. Coordinate with your infrastructure or platform teams to plan the upgrade, ensuring that any systems acting as clients to external VNC servers are addressed first to mitigate the risk of remote code execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.