Database/Kernel, userspace & hypervisor
xrdp: out-of-bounds read parsing Confirm Active PDU crashes the server or leaks process memory
Impact
xrdp through 0.10.5 reads from its buffer before checking the remaining length during RDP capability exchange. A crafted Confirm Active PDU crashes the xrdp process or returns fragments of its memory to the caller, which can include session state and credential material handled during logon. Where xrdp fronts remote-visualization or interactive login nodes in a GPU fleet, the service is reachable before any user authenticates, so a crash denies interactive access to the node for every user on it and the memory disclosure needs no account. Impact is limited to the xrdp process; the record describes denial of service and information disclosure, not code execution.
Who can reach it
Remote and unauthenticated - anyone who can open a TCP connection to the xrdp listener (typically 3389). No credentials, no existing session.
What to do
Upgrade xrdp to 0.10.6 and restart the xrdp service; active remote desktop sessions on that host are dropped, so schedule it per node, but no reboot or drain of GPU workloads is needed. Until patched, restrict the listener to a management network or VPN rather than leaving it open to tenants or the internet.
References
Related entries
- Linux kernel virtio-gpu: unvalidated EDID block offset lets a malicious backend read past a kernel bufferCVE-2026-68255 · Linux kernel drm/virtio (virtio_get_edid_block response bounds)High
- Linux kernel (drivers/pci): The option-ROM parser trusts the header and data-structure offsets it reads out of theCVE-2026-72487 · Linux kernel (drivers/pci)High
- VMware Tools for Windows: improper authorisation lets a guest user reach other guest VMs on the same vCenter or ESXCVE-2025-41246 · VMware Tools for Windows (guest access control)High
- Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough): Buffer overflow on the MSI-X table write pathCVE-2015-8554 · Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough)High
- Linux kernel RDS net/rds/recv.c - rds_inc_info_copy: A structure member is left uninitialised before the RDS messageCVE-2016-5244 · Linux kernel RDS net/rds/recv.c - rds_inc_info_copyHigh
- OpenSSL: malicious TLS server can hang a client with an oversized DH primeCVE-2018-0732 · OpenSSL (DH/DHE key agreement in the TLS client)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.