CVE-2026-35512 xrdp: Heap buffer overflow in EGFX channel
A heap buffer overflow in xrdp allows attackers to cause denial of service or potentially execute code via crafted PDUs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35512?
CVE-2026-35512 is a high-severity memory corruption vulnerability in neutrinolabs xrdp, published on 17 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
xrdp is an open source RDP server. Versions through 0.10.5 have a heap-based buffer overflow in the EGFX (graphics dynamic virtual channel) implementation due to insufficient validation of client-controlled size parameters, allowing an out-of-bounds write via crafted PDUs. Pre-authentication exploitation can crash the process, while post-authentication exploitation may achieve remote code execution. This issue has been fixed in version 0.10.6. If users are unable to immediately update, they should run xrdp as a non-privileged user (default since 0.10.2) to limit the impact of successful exploitation.
Weakness: CWE-122
Which versions are affected by CVE-2026-35512?
It affects 1 product.
Products include Neutrinolabs Xrdp.
How do I fix CVE-2026-35512?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-35512 being exploited?
There is no known exploitation of CVE-2026-35512 in the wild and no public exploit code.
Other vulnerabilities in neutrinolabs xrdp
- CVE-2026-41252 xrdp: lib_palette_update Heap Buffer Overflow & RCE
- CVE-2026-32105 xrdp: RDP MAC signature (dataSignature) never verified on receive — integrity bypass in non-TLS mode
- CVE-2026-44178 xrdp: Channel Data Forwarding Fixed-Size Buffer Overflow
- CVE-2026-32107 xrdp: Fail-open privilege drop in sesexec — child processes may execute as root if setuid fails
- CVE-2026-33689 xrdp: Pre-authentication out-of-bounds reads in channel parsers
Sources
Also known as DEBIAN-CVE-2026-35512, GHSA-jg6p-7fg8-9hh6, UBUNTU-CVE-2026-35512.