xrdp versions 0.10.6 and earlier contain a flaw in how the totalLength field of the TS_SHARECONTROLHEADER RDP packet is validated. If a packet with an invalid totalLength of zero is received, xrdp fails to advance its internal pointer and bypasses the deadlock prevention logic, causing the process to enter an infinite CPU‑bound loop. This loop consumes unlimited processor resources and can render the xrdp service unavailable, potentially leading to system‑wide resource depletion when multiple attackers connect simultaneously. The vulnerability is exploitable by an unauthenticated attacker who can target the service over TCP before authentication occurs.

neutrinolabs xrdp, versions 0.10.6 and all releases prior to 0.10.6.1.

The CVSS score of 7.5 classifies the issue as high severity. The EPSS score is < 1%, indicating a very low exploitation probability. It is not listed in the CISA KEV catalog. Because an attacker can trigger the defect with a specially crafted packet on the network before authentication, the attack vector is remote, unauthenticated. Exploitation would result in denial of service and, if repeated, could exhaust system resources. The flaw is essentially an infinite loop (CWE‑835).