The vulnerability is an out‑of‑bounds memory read triggered when xrdp parses Client Control PDUs during the RDP connection sequence. Because the parser does not perform sufficient length validation before reading fields from the network stream, it is inferred that a malicious actor could send a truncated, crafted PDU, causing the xrdp process to read memory beyond the boundary of the intended buffer. The read does not corrupt memory, but it can lead to a process crash, resulting in a temporary denial of service of the affected RDP session. The flaw is remote, unauthenticated, and doesn't allow code execution or privilege escalation. Its CVSS score is 6.5, reflecting moderate severity for denial of service and increased complexity from requiring an RDP connection.

Affected products are the Neutrinolabs xrdp RDP server. Versions 0.10.6 and all prior releases contain the flaw; the issue was resolved in version 0.10.6.1 and later. Security administrators should verify the version of xrdp installed on any machines that expose RDP services to address the problem.

The vulnerability has a CVSS score of 6.5, indicating moderate risk. The EPSS score is < 1%, showing a very low exploitation probability. The flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack requires establishing an RDP session and sending a malformed Client Control PDU, which is a relatively simple path for an attacker who can reach the server. If triggered, the out‑of‑bounds read causes the xrdp process to exit, which may temporarily reduce the number of active RDP listeners due to the default forking behavior, but it does not normally bring down the entire xrdp service. Nonetheless, repeated crashes could degrade service availability and serve as a vector for denial of service.