A heap out‑of‑bounds read occurs when the FIPS padding length is not validated during the HMAC verification phase of the RDP security layer. An unauthenticated remote attacker can craft a FIPS‑protected PDU that triggers a pointer underflow and a negative length calculation, leading to a process crash. The impact is a denial of service on the bad connection rather than arbitrary code execution.

Neutrinolabs xrdp – versions 0.10.6 and earlier are vulnerable. The issue is fixed in 0.10.6.1 and later releases. The flaw only manifests when the configuration sets security_layer to negotiate or rdp and crypt_level to fips in xrdp.ini.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog. The exploit requires remote network access and specific configuration changes, so it is not trivially exploitable in default deployments. Failure of a single connection process is unlikely to bring down the entire xrdp service because the server forks a new process for each session, but repeated crashes could degrade service availability.