An integer overflow occurs in the lib_framebuffer_update component of the xrdp VNC extension when a remote VNC server sends screen update messages with crafted image dimensions. The overflow causes an undersized memory allocation, and subsequent processing uses the original oversized parameters, leading to an out‑of‑bounds read that can leak sensitive heap contents. The flaw can also trigger a denial of service if the read corrupts control structures. The vulnerability requires no authentication and can be triggered by any malicious VNC server that an xrdp client connects to.

Neutrinolabs’ xrdp server, versions 0.10.6 and earlier. The issue has been resolved in the 0.10.6.1 release and later updates. Systems running the affected packages without the patch are at risk.

The CVSS score of 8.2 indicates high severity. The EPSS score is < 1%, indicating a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw remotely by hosting a rogue VNC server that sends specially crafted screen update messages; authentication is not required. Because the attack involves sending data over the network, the risk is bounded to users that allow untrusted VNC servers through xrdp. The lack of authentication or additional checks makes the threat easy to execute against exposed xrdp instances.