xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8476-1 advisory.

    It was discovered that xrdp incorrectly handled bounds checking when processing user domain information     during the connection sequence. An unauthenticated remote attacker could use this issue to cause xrdp to     crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-68670)

    It was discovered that xrdp did not correctly enforce the maximum number of login attempts configured by     the MaxLoginRetry parameter. A remote attacker could use this issue to perform an unlimited number of     login attempts. (CVE-2024-39917)

    It was discovered that xrdp did not perform bounds checking when accessing font glyphs. Since some of this     data is controllable by the user, a remote attacker could use this issue to cause xrdp to read out of     bounds. This issue only affected Ubuntu 24.04 LTS. (CVE-2023-42822)

    It was discovered that xrdp did not properly handle session establishment errors. A remote attacker could     use this issue to bypass OS-level session restrictions enforced by PAM, such as the maximum number of     concurrent sessions per user. This issue only affected Ubuntu 24.04 LTS. (CVE-2023-40184)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0477-1 advisory.

    - CVE-2025-68670: Fix a potential overflow when processing user domain information. (bsc#1257362)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0433-1 advisory.

    - CVE-2025-68670: Fix a potential overflow when processing user domain information. (bsc#1257362)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:0404-1 advisory.

    - CVE-2025-68670: Fix a potential overflow when processing user domain information. (bsc#1257362)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-febea89ac3 advisory.

    Release notes for xrdp v0.10.5 (2026/01/27)

    Security fixes

    - CVE-2025-68670: Improper bounds checking of domain string length leads to Stack-based Buffer Overflow

    New features

    - It is now possible to start the xrdp daemon entirely unprivileged from the service manager (#3599     #3603). If you do this certain restrictions will apply. See     https://github.com/neutrinolabs/xrdp/wiki/Running-the-xrdp-process-as-non-root for details.
    - TLS pre-master secrets can now be recorded for packet captures (#3617)
    - Add a FuseRootReportMaxFree to work around 'no free space' issues with some file managers (#3639)
    - Alternate shell names can now be passed to startwm.sh in an environment variable for more system     management control (#3624 #3651)
    - Updated Xorg paths in sesman.ini to include more recent distros (#3663)
    - Add Slovenian keyboard (#3668 #3670)
    - xrdpapi: Add a way to monitor connect/disconnect events (#3693)

    Bug fixes

    - Allow an empty X11 UTF8_STRING to be pasted to the clipboard (#3580 #3582)
    - Fix a regression introduced in v0.10.x, where it became impossible to connect to a VNC server which did     not support the ExtendedDesktopSize encoding (#3540 #3584)
    - Fix a regression introduced in v0.10.x related to PAM groups handling (#3594)
    - Inconsistencies with [MS-RDPBCGR] have been addressed (#3608)
    - A reference to uninitialised data within the verify_user_pam_userpass.c module has been fixed (#3638)
    - Prevent some possible crashes when the RFX encoder is resized (#3590 #3644)
    - Fixes a regression introduced by GFX development which prevented the JPEG encoder from working correctly     (#3649)
    - Fixes a regression introduced by #2974 which resulted in the xrdp PID file being deleted unexpectedly     (#3650)
    - Do not overwrite a VNC port set by the user when not using sesman (#3674)
    - Fix regression from 0.9.x when freerdp client uses /workarea (#3618 #3676)
    - Fixes a crash where a resize is attempted with drdynvc disabled (#3672 #3680)
    - getgrouplist() now compiles on MacOS (#3575)
    - Various Coverity warnings have been addressed (#3656)
    - Documentation improvements (#3665)

    Internal changes

    - An unnecessary include of sys/signal.h causing a compile warning on MUSL-C has been removed (#3679)

    Release notes for xorgxrdp v0.10.5 (2026/01/28)

    Bug fixes

    - Fix bug in Chrome pointer detection (#394 #396)

    Internal changes

    - CI: Update FreeBSD xrdp dependency (#398)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-b409dad73e advisory.

    Release notes for xrdp v0.10.5 (2026/01/27)

    Security fixes

    - CVE-2025-68670: Improper bounds checking of domain string length leads to Stack-based Buffer Overflow

    New features

    - It is now possible to start the xrdp daemon entirely unprivileged from the service manager (#3599     #3603). If you do this certain restrictions will apply. See     https://github.com/neutrinolabs/xrdp/wiki/Running-the-xrdp-process-as-non-root for details.
    - TLS pre-master secrets can now be recorded for packet captures (#3617)
    - Add a FuseRootReportMaxFree to work around 'no free space' issues with some file managers (#3639)
    - Alternate shell names can now be passed to startwm.sh in an environment variable for more system     management control (#3624 #3651)
    - Updated Xorg paths in sesman.ini to include more recent distros (#3663)
    - Add Slovenian keyboard (#3668 #3670)
    - xrdpapi: Add a way to monitor connect/disconnect events (#3693)

    Bug fixes

    - Allow an empty X11 UTF8_STRING to be pasted to the clipboard (#3580 #3582)
    - Fix a regression introduced in v0.10.x, where it became impossible to connect to a VNC server which did     not support the ExtendedDesktopSize encoding (#3540 #3584)
    - Fix a regression introduced in v0.10.x related to PAM groups handling (#3594)
    - Inconsistencies with [MS-RDPBCGR] have been addressed (#3608)
    - A reference to uninitialised data within the verify_user_pam_userpass.c module has been fixed (#3638)
    - Prevent some possible crashes when the RFX encoder is resized (#3590 #3644)
    - Fixes a regression introduced by GFX development which prevented the JPEG encoder from working correctly     (#3649)
    - Fixes a regression introduced by #2974 which resulted in the xrdp PID file being deleted unexpectedly     (#3650)
    - Do not overwrite a VNC port set by the user when not using sesman (#3674)
    - Fix regression from 0.9.x when freerdp client uses /workarea (#3618 #3676)
    - Fixes a crash where a resize is attempted with drdynvc disabled (#3672 #3680)
    - getgrouplist() now compiles on MacOS (#3575)
    - Various Coverity warnings have been addressed (#3656)
    - Documentation improvements (#3665)

    Internal changes

    - An unnecessary include of sys/signal.h causing a compile warning on MUSL-C has been removed (#3679)

    Release notes for xorgxrdp v0.10.5 (2026/01/28)

    Bug fixes

    - Fix bug in Chrome pointer detection (#394 #396)

    Internal changes

    - CI: Update FreeBSD xrdp dependency (#398)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has a package installed that is affected by a vulnerability as referenced in the dsa-6123 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6123-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     February 07, 2026                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : xrdp     CVE ID         : CVE-2025-68670     Debian Bug     : 1126537

    Denis Skvortsov discovered that xrdp, a Remote Desktop Protocol (RDP)     server, was susceptible to an unauthenticated stack-based buffer     overflow vulnerability, which may result in remote execution of     arbitrary code.

    For the oldstable distribution (bookworm), this problem has been fixed     in version 0.9.21.1-1+deb12u2.

    For the stable distribution (trixie), this problem has been fixed in     version 0.10.1-3.1+deb13u1.

    We recommend that you upgrade your xrdp packages.

    For the detailed security status of xrdp please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/xrdp

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20167-1 advisory.

    Changes in xrdp:

    - CVE-2025-68670: Fixed a potential overflow (bsc#1257362).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer
    overflow vulnerability. The issue stems from improper bounds checking when processing user domain
    information during the connection sequence. If exploited, the vulnerability could allow remote attackers
    to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the
    stack buffer and the return address, which could theoretically be used to redirect the execution flow. The
    impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable
    with stack canary protection. If this is the case, a second vulnerability would need to be used to leak
    the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack
    canary protection on production systems. (CVE-2025-68670)

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4464 advisory.

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-4464-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     February 03, 2026                           https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : xrdp     Version        : 0.9.21.1-1~deb11u3     CVE ID         : CVE-2025-68670     Debian Bug     : 1126537

    xrdp is an open source RDP server. It was found that xrdp contains an     unauthenticated stack-based buffer overflow vulnerability. The issue     stems from improper bounds checking when processing user domain     information during the connection sequence. If exploited, the     vulnerability could allow remote attackers to execute arbitrary code     on the target system.

    For Debian 11 bullseye, this problem has been fixed in version     0.9.21.1-1~deb11u3.

    We recommend that you upgrade your xrdp packages.

    For the detailed security status of xrdp please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/xrdp

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 232e16cc-fd83-11f0-981a-98b78501ef2a advisory.

    Denis Skvortsov, Security Researcher at Kaspersky reports:
    xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems     from improper bounds checking when processing user domain information during the connection sequence. If     exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
322953	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : xrdp vulnerabilities (USN-8476-1)	Nessus	Ubuntu Local Security Checks	critical
298918	SUSE SLES15 Security Update : xrdp (SUSE-SU-2026:0477-1)	Nessus	SuSE Local Security Checks	critical
298734	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : xrdp (SUSE-SU-2026:0433-1)	Nessus	SuSE Local Security Checks	critical
298412	SUSE SLES12 Security Update : xrdp (SUSE-SU-2026:0404-1)	Nessus	SuSE Local Security Checks	critical
298313	Fedora 43 : xorgxrdp / xrdp (2026-febea89ac3)	Nessus	Fedora Local Security Checks	critical
298310	Fedora 42 : xorgxrdp / xrdp (2026-b409dad73e)	Nessus	Fedora Local Security Checks	critical
298304	Debian dsa-6123 : xrdp - security update	Nessus	Debian Local Security Checks	critical
297980	openSUSE 16 Security Update : xrdp (openSUSE-SU-2026:20167-1)	Nessus	SuSE Local Security Checks	critical
437467	Alpine: multiple xrdp packages: security update to 0.10.5-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
437467	Alpine: multiple xrdp packages: security update to 0.10.5-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
297582	Debian dla-4464 : xrdp - security update	Nessus	Debian Local Security Checks	critical
297436	FreeBSD : xrdp -- remote code execution (232e16cc-fd83-11f0-981a-98b78501ef2a)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2025-68670

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical