xrdp is an open source RDP server. Versions through 0.10.5 have an out-of-bounds read vulnerability in the pre-authentication RDP message parsing logic. A remote, unauthenticated attacker can trigger this flaw by sending a specially crafted sequence of packets during the initial connection phase. This vulnerability results from insufficient validation of input buffer lengths before processing dynamic channel communication. Successful exploitation can lead to a denial-of-service (DoS) condition via a process crash or potential disclosure of sensitive information from the service's memory space. This issue has been fixed in version 0.10.6.

The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6469 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6469-1                   security@debian.org     https://www.debian.org/security/                                  Aron Xu     August 27, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : xrdp     CVE ID         : CVE-2026-32105 CVE-2026-32107 CVE-2026-32623 CVE-2026-32624                      CVE-2026-33145 CVE-2026-33516 CVE-2026-33689 CVE-2026-35512                      CVE-2026-41252 CVE-2026-41521 CVE-2026-42218 CVE-2026-44178                      CVE-2026-44978 CVE-2026-54538 CVE-2026-55238 CVE-2026-55639                      CVE-2026-55645     Debian Bug     : 1134339

    Multiple vulnerabilities were discovered in xrdp, a Remote Desktop     Protocol (RDP) server, which may result in denial of service,     information disclosure, privilege escalation or the execution of     arbitrary code. Several of these issues are exploitable by an     unauthenticated remote attacker.

    This update also changes two defaults, as part of the fixes:

     * Alternate shells supplied by the client are now rejected unless        AllowAlternateShell is explicitly enabled in /etc/xrdp/sesman.ini.
       This is the fix for CVE-2026-33145 and applies even on systems with        a locally modified sesman.ini.

     * The generic VNC proxy session type [vnc-any] is now commented out in        /etc/xrdp/xrdp.ini. It was reachable before authentication and        exposed CVE-2026-41252 and CVE-2026-41521 to unauthenticated        clients. Administrators who need it should re-enable it and restrict        it to specific hosts and ports.

    For the stable distribution (trixie), these problems have been fixed in     version 0.10.1-3.1+deb13u2.

    We recommend that you upgrade your xrdp packages.

    For the detailed security status of xrdp please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/xrdp

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9417ff0bc5 advisory.

    Security fixes

    - CVE-2026-32105
    - CVE-2026-32107
    - CVE-2026-32623
    - CVE-2026-32624
    - CVE-2026-33145
    - CVE-2026-33516
    - CVE-2026-33689
    - CVE-2026-35512

    New features

    - Support for xorgxrdp bug fixes #249 and #342 (#3721)

    Bug fixes

    - Honour pass_shell_as_env setting only if user sets a shell (#3725)
    - We no longer try to create a NULL authentication file when using VNC over UDS (#3727)
    - Problems with the Brazilian ABNT2 keyboard mapping have been corrected (#3728 3736)
    - A 'file exists' error when installing xrdp over an existing installation has been addressed (#3780)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f04c228c78 advisory.

    Security fixes

    - CVE-2026-32105
    - CVE-2026-32107
    - CVE-2026-32623
    - CVE-2026-32624
    - CVE-2026-33145
    - CVE-2026-33516
    - CVE-2026-33689
    - CVE-2026-35512

    New features

    - Support for xorgxrdp bug fixes #249 and #342 (#3721)

    Bug fixes

    - Honour pass_shell_as_env setting only if user sets a shell (#3725)
    - We no longer try to create a NULL authentication file when using VNC over UDS (#3727)
    - Problems with the Brazilian ABNT2 keyboard mapping have been corrected (#3728 3736)
    - A 'file exists' error when installing xrdp over an existing installation has been addressed (#3780)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ad9e109ad8 advisory.

    Security fixes

    - CVE-2026-32105
    - CVE-2026-32107
    - CVE-2026-32623
    - CVE-2026-32624
    - CVE-2026-33145
    - CVE-2026-33516
    - CVE-2026-33689
    - CVE-2026-35512

    New features

    - Support for xorgxrdp bug fixes #249 and #342 (#3721)

    Bug fixes

    - Honour pass_shell_as_env setting only if user sets a shell (#3725)
    - We no longer try to create a NULL authentication file when using VNC over UDS (#3727)
    - Problems with the Brazilian ABNT2 keyboard mapping have been corrected (#3728 3736)
    - A 'file exists' error when installing xrdp over an existing installation has been addressed (#3780)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - xrdp is an open source RDP server. Versions through 0.10.5 have an out-of-bounds read vulnerability in the
    pre-authentication RDP message parsing logic. A remote, unauthenticated attacker can trigger this flaw by
    sending a specially crafted sequence of packets during the initial connection phase. This vulnerability
    results from insufficient validation of input buffer lengths before processing dynamic channel
    communication. Successful exploitation can lead to a denial-of-service (DoS) condition via a process crash
    or potential disclosure of sensitive information from the service's memory space. This issue has been
    fixed in version 0.10.6. (CVE-2026-33689)

  - xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement verification for
    the Message Authentication Code (MAC) signature of encrypted RDP packets when using the "Classic RDP
    Security" layer. While the sender correctly generates signatures, the receiving logic lacks the necessary
    implementation to validate the 8-byte integrity signature, causing it to be silently ignored. An
    unauthenticated attacker with man-in-the-middle (MITM) capabilities can exploit this missing check to
    modify encrypted traffic in transit without detection. It does not affect connections where the TLS
    security layer is enforced. This issue has been fixed in version 0.10.6. If users are unable to
    immediately upgrade, they should configure xrdp.ini to enforce TLS security (security_layer=tls) to ensure
    end-to-end integrity. (CVE-2026-32105)

  - xrdp is an open source RDP server. In versions through 0.10.5, the session execution component did not
    properly handle an error during the privilege drop process. This improper privilege management could allow
    an authenticated local attacker to escalate privileges to root and execute arbitrary code on the system.
    An additional exploit would be needed to facilitate this. This issue has been fixed in version 0.10.6.
    (CVE-2026-32107)

  - xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow
    vulnerability in the NeutrinoRDP module. When proxying RDP sessions from xrdp to another server, the
    module fails to properly validate the size of reassembled fragmented virtual channel data against its
    allocated memory buffer. A malicious downstream RDP server (or an attacker capable of performing a Man-in-
    the-Middle attack) could exploit this flaw to cause memory corruption, potentially leading to a Denial of
    Service (DoS) or Remote Code Execution (RCE). The NeutrinoRDP module is not built by default. This
    vulnerability only affects environments where the module has been explicitly compiled and enabled. Users
    can verify if the module is built by checking for --enable-neutrinordp in the output of the xrdp -v
    command. This issue has been fixed in version 0.10.6. (CVE-2026-32623)

  - xrdp is an open source RDP server. Versions through 0.10.5 contain a heap-based buffer overflow
    vulnerability in its logon processing. In environments where domain_user_separator is configured in
    xrdp.ini, an unauthenticated remote attacker can send a crafted, excessively long username and domain name
    to overflow the internal buffer. This can corrupt adjacent memory regions, potentially leading to a Denial
    of Service (DoS) or unexpected behavior. The domain_name_separator directive is commented out by default,
    systems are not affected by this vulnerability unless it is intentionally configured. This issue has been
    fixed in version 0.10.6. (CVE-2026-32624)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - xrdp is an open source RDP server. Versions through 0.10.5 have an out-of-bounds read vulnerability in the     pre-authentication RDP message parsing logic. A remote, unauthenticated attacker can trigger this flaw by     sending a specially crafted sequence of packets during the initial connection phase. This vulnerability     results from insufficient validation of input buffer lengths before processing dynamic channel     communication. Successful exploitation can lead to a denial-of-service (DoS) condition via a process crash     or potential disclosure of sensitive information from the service's memory space. This issue has been     fixed in version 0.10.6. (CVE-2026-33689)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
341057	Debian dsa-6469 : xrdp - security update	Nessus	Debian Local Security Checks	Local	critical
310599	Fedora 43 : xrdp (2026-9417ff0bc5)	Nessus	Fedora Local Security Checks	Local	critical
310596	Fedora 42 : xrdp (2026-f04c228c78)	Nessus	Fedora Local Security Checks	Local	critical
310590	Fedora 44 : xrdp (2026-ad9e109ad8)	Nessus	Fedora Local Security Checks	Local	critical
440774	Alpine: multiple xrdp packages: security update to 0.10.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
440774	Alpine: multiple xrdp packages: security update to 0.10.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
307460	Linux Distros Unpatched Vulnerability : CVE-2026-33689	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-33689

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

high