xrdp includes an out-of-bounds read during the pre‑authentication RDP message parsing phase. An attacker can send a crafted sequence of packets before authentication is completed, causing the program to read beyond the bounds of the input buffer. The resulting memory corruption can trigger a process crash, producing a denial‑of‑service, or in some scenarios allow the attacker to read sensitive data from service memory. The flaw arises from insufficient validation of buffer lengths in the dynamic channel communication logic.

The affected product is the open‑source xrdp server from Neutrinolabs. Vulnerable versions are 0.10.5 and older. The issue was fixed with the release of version 0.10.6.

The CVSS score of 8.7 indicates a high severity vulnerability. EPSS data are not available, and the flaw is not listed in the CISA KEV catalog. An attacker need only be able to establish an initial RDP connection to the target system; the flaw is triggered during the pre‑authentication message exchange, allowing remote, unauthenticated exploitation. Given the high score and the nature of the attack vector, organizations should treat this as an urgent risk.