The vulnerability is a heap‑based buffer overflow in the virtual channel forwarding component of xrdp. When an authenticated remote client sends a virtual channel message that exceeds the fixed‑size buffer, the xrdp process loses bounds checking on the payload, corrupting heap memory. This corruption can lead to denial of service or allow the attacker to execute code with the privileges of the xrdp process. The flaw is rooted in CWE‑122 and would affect the confidentiality, integrity, and availability of compromised systems.

The flaw impacts versions of xrdp 0.10.6 and earlier distributed by neutrinolabs. Systems running these releases expose an authenticated remote channel that should be upgraded to 0.10.6.1 or later to receive the fix that implements proper bounds checking.

The CVSS score of 8.8 signals a high‑severity vulnerability, and the EPSS score of < 1% indicates a low but non‑zero exploitation probability. The issue is not listed in the CISA KEV catalog. The attack vector is remote and requires authentication, implying that only users who can log into the server via RDP can trigger the overflow. Once triggered, the attacker can cause service interruption or arbitrary code execution, giving them control over the server’s process space.