CVE-2026-32105 xrdp: RDP MAC signature (dataSignature) never verified on receive — integrity bypass in non-TLS mode
An attacker with man-in-the-middle capabilities can modify encrypted RDP traffic undetected when TLS is not enforced, bypassing integrity checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32105?
CVE-2026-32105 is a critical vulnerability in neutrinolabs xrdp, published on 17 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement verification for the Message Authentication Code (MAC) signature of encrypted RDP packets when using the "Classic RDP Security" layer. While the sender correctly generates signatures, the receiving logic lacks the necessary implementation to validate the 8-byte integrity signature, causing it to be silently ignored. An unauthenticated attacker with man-in-the-middle (MITM) capabilities can exploit this missing check to modify encrypted traffic in transit without detection. It does not affect connections where the TLS security layer is enforced. This issue has been fixed in version 0.10.6. If users are unable to immediately upgrade, they should configure xrdp.ini to enforce TLS security (security_layer=tls) to ensure end-to-end integrity.
Weakness: CWE-354
Which versions are affected by CVE-2026-32105?
It affects 1 product.
Products include Neutrinolabs Xrdp.
How do I fix CVE-2026-32105?
Upgrade to a fixed version.
Is CVE-2026-32105 being exploited?
There is no known exploitation of CVE-2026-32105 in the wild and no public exploit code.
Other vulnerabilities in neutrinolabs xrdp
- CVE-2026-41252 xrdp: lib_palette_update Heap Buffer Overflow & RCE
- CVE-2026-44178 xrdp: Channel Data Forwarding Fixed-Size Buffer Overflow
- CVE-2026-32107 xrdp: Fail-open privilege drop in sesexec — child processes may execute as root if setuid fails
- CVE-2026-33689 xrdp: Pre-authentication out-of-bounds reads in channel parsers
- CVE-2026-35512 xrdp: Heap buffer overflow in EGFX channel
Sources
Also known as DEBIAN-CVE-2026-32105, GHSA-j2jm-c596-c5q3, UBUNTU-CVE-2026-32105.