CVE-2026-44178 xrdp: Channel Data Forwarding Fixed-Size Buffer Overflow

High 8.8 Published 20 Jul 2026 Updated 23 Jul 2026

An authenticated remote attacker can trigger a heap buffer overflow in xrdp via crafted virtual channel messages, potentially leading to arbitrary code execution or denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-44178?

CVE-2026-44178 is a high-severity memory corruption vulnerability in neutrinolabs xrdp, published on 20 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer without adequate bounds checking on the incoming payload. An authenticated remote attacker can exploit this flaw by sending a specially crafted virtual channel message that exceeds the buffer capacity, leading to heap memory corruption. This may result in a denial of service or the execution of arbitrary code with the privileges of the xrdp process. This issue has been fixed in version 0.10.6.1.

Weakness: CWE-122

Which versions are affected by CVE-2026-44178?

It affects 1 product.

Products include Neutrinolabs Xrdp.

How do I fix CVE-2026-44178?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-44178 being exploited?

There is no known exploitation of CVE-2026-44178 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-44178, GHSA-hh7r-2rmq-q4g4, UBUNTU-CVE-2026-44178.