xrdp contains a heap-based buffer overflow in the NeutrinoRDP module that fails to validate the size of reassembled fragmented virtual channel data. This flaw allows an attacker to corrupt memory, potentially causing a denial of service or enabling remote code execution. Based on the description, the attack vector involves a malicious downstream RDP server or an attacker capable of performing a Man‑in‑the‑Middle attack, inferred from the need for the module to be explicitly compiled and enabled while routing sessions through a controlled downstream server.

The vulnerability affects NeutrinoLabs xrdp versions 0.10.5 and earlier when the NeutrinoRDP module is explicitly compiled and enabled with the --enable-neutrinordp configuration switch. Versions 0.10.6 and newer include a fix, and the module is not compiled by default.

The likely attack vector is exploitation through an upstream RDP client that proxies a session via the vulnerable module to a downstream RDP server controlled by an adversary, or via a man‑in‑the‑middle attack. The CVSS score of 7.7 reflects a high severity, and the EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting limited publicly confirmed exploitation activity. Attacks require an upstream RDP client to proxy a session through the vulnerable module to a downstream RDP server that is controlled by an adversary or via a man‑in‑the‑middle attack; thus the threat is constrained to environments that enable RDP session proxying through this module, but once the conditions are met, exploitation can lead to significant compromise.