The vulnerability arises because xrdp fails to verify the Message Authentication Code (MAC) signature that is inserted into encrypted RDP packets when the "Classic RDP Security" layer is used. The sender correctly generates an 8‑byte integrity signature, but the receiver never checks it, causing any modifications to the packet contents to be silently accepted. An attacker who can observe the connection—such as through a man‑in‑the‑middle position—could therefore alter traffic without detection, potentially affecting session data, user credentials, or other sensitive information. This flaw does not affect connections that use the TLS security layer, where integrity is already protected.

The flaw impacts the neutrinolabs xrdp product for all releases up to and including version 0.10.5. The offending code was addressed in version 0.10.6, making that and later releases immune to the issue.

With a CVSS score of 9.3 the vulnerability is rated critical. The EPSS score is not available, but the lack of a publicly listed KEV entry does not diminish the risk. An exploit requires the attacker to be able to intercept RDP traffic while the server is using Classic RDP Security, a common scenario on networks that permit RDP or in environments that have not mandated TLS. If these conditions exist, exploitation is straightforward and can occur without authentication. The potential impact is high because traffic can be modified undetected.