This vulnerability arises from a missing bounds check in xrdp's handling of the RFB protocol color map messages while operating in vnc-any mode. The flaw allows a heap-based buffer overflow (CWE-122) when a VNC server sends color indices outside the valid range. A malicious VNC server can construct such messages to trigger an out-of-bounds write on the heap, potentially leading to a denial of service or remote code execution before any authentication occurs.

Neutrinolabs xrdp. The vendor released a patch in version 0.10.6.1 that resolves the bounds check issue. No other product versions are known to be impacted.

The CVSS base score of 9.8 indicates critical severity. The EPSS score is less than 1%, indicating a low but non-zero probability that the vulnerability will be exploited in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be able to communicate with the xrdp server in vnc-any mode, deliver crafted RFB protocol messages, and trigger the heap overflow. Once the overflow occurs, remote code execution can be achieved before authentication.