A heap-based buffer overflow exists in the EGFX channel of the xrdp RDP server. The flaw arises from insufficient validation of client‑controlled size fields, allowing an out‑of‑bounds write when the server parses crafted PDUs. When exploited before authentication the process can be crashed, and if authentication succeeds the attacker can achieve remote code execution, thereby obtaining full control of the host. This vulnerability is identified as CWE‑122.

The issue affects neutrinolabs xrdp server versions 0.10.5 and earlier. The fix was released in version 0.10.6; earlier releases remain vulnerable.

The CVSS base score of 8.7 indicates a high‑severity flaw with implied network attack vector and no privilege requirement. The EPSS score is not reported, and the vulnerability is not yet listed in the CISA KEV catalog. Based on the description, the most likely attack involves a malicious RDP client sending specially crafted EGFX packets to a publicly exposed xrdp instance; pre‑authentication exploitation can cause a crash, while post‑authentication exploitation enables arbitrary code execution.