xrdp
- Software type
- Remote access
- Total vulnerabilities (90 days)
- 10
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/08/2026, xrdp recorded 10 security vulnerabilities in the last 90 days, of which 5 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of xrdp and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-55639xrdp: Out-of-bounds read in GCC Conference Create Request CS_SECURITY processing (xrdp_sec_process_mcs_data_CS_SECURITY)CVE-2026-55626xrdp: No authentication required with Xvnc backend on RHEL 9CVE-2026-55238xrdp: Malformed Confirm Active capability sets cause out-of-bounds readsCVE-2026-54538xrdp: Pre-auth infinite loop via totalLength=0 in TS_SHARECONTROLHEADERCVE-2026-44978xrdp: Unchecked FIPS padding length in standard RDP Security causes heap out-of-bounds read in HMAC verification| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-55639xrdp: Out-of-bounds read in GCC Conference Create Request CS_SECURITY processing (xrdp_sec_process_mcs_data_CS_SECURITY) | Exploitation statusNot exploited | FixYes |
| SeverityMedium |
CVE-2026-55626xrdp: No authentication required with Xvnc backend on RHEL 9 | Exploitation statusNot exploited | FixYes | Published07/20/2026 | SeverityHigh |
|---|
CVE-2026-55238xrdp: Malformed Confirm Active capability sets cause out-of-bounds reads | Exploitation statusNot exploited | FixYes | Published07/20/2026 | SeverityMedium |
|---|
CVE-2026-54538xrdp: Pre-auth infinite loop via totalLength=0 in TS_SHARECONTROLHEADER | Exploitation statusNot exploited | FixYes | Published07/20/2026 | SeverityHigh |
|---|
CVE-2026-44978xrdp: Unchecked FIPS padding length in standard RDP Security causes heap out-of-bounds read in HMAC verification | Exploitation statusNot exploited | FixYes | Published07/20/2026 | SeverityMedium |
|---|
CVE-2026-44178xrdp: Channel Data Forwarding Fixed-Size Buffer Overflow | Exploitation statusNot exploited | FixYes | Published07/20/2026 | SeverityHigh |
|---|
CVE-2026-55645xrdp: Out-of-bounds read in Client Control PDU processing (xrdp_rdp_process_data_control) | Exploitation statusNot exploited | FixYes | Published07/20/2026 | SeverityMedium |
|---|
CVE-2026-42218XRDP is vulnerable to a server timing attack, leading to user enumeration | Exploitation statusNot exploited | FixYes | Published07/20/2026 | SeverityMedium |
|---|
CVE-2026-41521xrdp: lib_framebuffer_update Has Integer Overflow Heap Info Leak & ASLR Bypass | Exploitation statusNot exploited | FixYes | Published07/20/2026 | SeverityHigh |
|---|
CVE-2026-41252xrdp: lib_palette_update Heap Buffer Overflow & RCE | Exploitation statusNot exploited | FixYes | Published07/20/2026 | SeverityCritical |
|---|
37 Results | Page 1 of 4