xrdp is an open source Remote Desktop Protocol server that contains a heap-based buffer overflow in its logon processing. The vulnerability is triggered when the domain_user_separator setting is enabled in xrdp.ini and an unauthenticated remote attacker sends a username or domain name that is excessively long. The overflow corrupts adjacent memory regions, which can cause the application to crash or exhibit other unexpected behavior. The exploit does not provide code execution but can abruptly terminate the service, leading to a denial of service.

The affected product is xrdp from the Neutrinolabs project. Versions up through 0.10.5 are vulnerable; the issue was fixed in 0.10.6 and later releases. Only systems that have explicitly enabled the domain_user_separator configuration are at risk.

The CVSS score of 6.3 reflects a moderate severity, and no EPSS score is available. The vulnerability is not listed in CISA's KEV catalog. The attack vector is remote and unauthenticated: an attacker simply needs the ability to connect to the xrdp service and send a crafted logon request when domain_user_separator is configured. Even though the exploit is limited to causing service disruption, it is potentially exploitable by attackers who target high-availability environments or services that rely on uninterrupted RDP access.