External risk intelligence

xrdp Integer Overflow Leads to Information Disclosure and DoS

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-41521

The vulnerability exists in xrdp's vnc-any connection mode. While xrdp is often public-facing, this specific issue requires the server to act as a client connecting to a malicious backend VNC server. This configuration is typically internal or segmented, making the specific attack vector of a compromised or malicious VNC backend less common for standard public-facing RDP endpoints.

Integer Overflow

Neutrinolabs Xrdp

before 0.10.6.1

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in xrdp, an open-source Remote Desktop Protocol server. The flaw exists when processing screen updates in a specific connection mode, potentially allowing unauthenticated remote attackers to read sensitive information from memory or cause denial of service by crashing the affected service. The main concern is confirming relevance and exposure.

An RDP server flaw allows attackers to read memory or crash it.
Matters if your RDP server connects to other VNC servers.
Confirm if this specific RDP connection mode is used.

Attack Path

How an attacker could exploit the issue

A remote attacker could trick an xrdp server into connecting to a malicious VNC server. When xrdp processes screen updates from this malicious VNC server, an integer overflow can occur. This flaw may allow the attacker to read sensitive information from the server's memory or cause the server to crash.

Attacker controls a VNC server.
Server processes screen updates.
Sensitive information disclosure or DoS.

Live Threat

Current exploitation, exposure, and threat context

When xrdp is configured to connect to VNC servers, an unauthenticated remote attacker controlling a malicious VNC server could cause the xrdp process to read sensitive information from its heap memory or crash due to an integer overflow vulnerability in screen update processing.

Heap memory could be disclosed.
Attack requires VNC connection mode.
Information disclosure or denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in xrdp's VNC connection mode impacts infrastructure and platform teams responsible for remote access services. The initial step is to inventory all xrdp deployments, determine if they are configured for VNC-any mode, and assess their exposure to untrusted VNC servers. Confirming ownership and business criticality will guide the prioritization of remediation efforts.

Confirm xrdp's VNC-any connection mode usage.
Identify and prioritize exposed xrdp instances.
Plan and coordinate targeted updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is xrdp and how is it used?

xrdp is an open-source server application that implements the Remote Desktop Protocol (RDP). It allows users to connect to Linux-based desktop environments from various remote clients. It is commonly used by system administrators and developers to provide graphical remote access to servers and workstations, bridging the gap between RDP-based clients and Unix-like operating systems.

How does CVE-2026-41521 cause a security weakness?

This vulnerability is an integer overflow, categorized as CWE-190. When xrdp processes screen update data in a specific connection mode, it performs math on image dimensions to allocate memory. An attacker can provide manipulated dimensions that cause this calculation to wrap around, resulting in a buffer that is too small. When the server later writes image data into this undersized buffer, it leads to an out-of-bounds read, potentially leaking sensitive memory or causing a service crash.

What triggers this vulnerability in xrdp?

The flaw is triggered specifically when the xrdp server is configured to use the 'vnc-any' connection mode and acts as a client connecting to a malicious VNC server. This means standard RDP sessions that do not involve xrdp reaching out to a backend VNC server are not susceptible to this specific trigger path. The attacker must control the VNC server that the xrdp instance attempts to connect to.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal notes that while xrdp is often exposed to the internet, this specific issue requires a less common configuration where the server acts as a client for a malicious VNC backend. Because this backend connection is typically internal or segmented, the attack vector is not present in standard public-facing RDP setups. You should evaluate whether your xrdp instances are configured to bridge connections to VNC servers.

How should I respond to this advisory?

Start by identifying all xrdp deployments within your environment to see if they utilize the 'vnc-any' connection mode. If this mode is in use, determine if the xrdp server connects to any untrusted or accessible VNC endpoints. Prioritize these specific instances for updates. The issue is resolved in version 0.10.6.1, so updating your software to this release or newer will mitigate the risk of memory disclosure or denial of service.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.