CVE-2026-44978

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44978", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-08T16:23:33.264Z", "datePublished": "2026-07-20T16:56:03.216Z", "dateUpdated": "2026-07-21T16:04:45.918Z"}, "containers": {"cna": {"title": "xrdp: Unchecked FIPS padding length in standard RDP Security causes heap out-of-bounds read in HMAC verification", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-9cg5-f7m7-ppvj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-9cg5-f7m7-ppvj"}, {"name": "https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1"}], "affected": [{"vendor": "neutrinolabs", "product": "xrdp", "versions": [{"version": "< 0.10.6.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T16:56:03.216Z"}, "descriptions": [{"lang": "en", "value": "xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulnerability does not affect the default configuration of xrdp. The vulnerability is only exploitable when the security layer is set to security_layer=negotiate or security_layer=rdp, and the crypto level is changed to crypt_level=fips in xrdp.ini. In this specific non-default mode, the server fails to validate the FIPS padding length field, leading to a pointer underflow and a subsequent negative length calculation. An unauthenticated remote attacker can exploit this by sending a crafted FIPS-protected PDU, causing a heap out-of-bounds read that results in a process crash and denial of service (DoS). However, since xrdp forks a new process for each connection by default, an out-of-bounds read causing a process crash is unlikely to bring down the entire xrdp service. This issue has been fixed in version 0.10.6.1."}], "source": {"advisory": "GHSA-9cg5-f7m7-ppvj", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-21T16:03:54.447257Z", "id": "CVE-2026-44978", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T16:04:45.918Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44978", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T16:03:54.447257Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T16:04:05.197Z"}}], "cna": {"title": "xrdp: Unchecked FIPS padding length in standard RDP Security causes heap out-of-bounds read in HMAC verification", "source": {"advisory": "GHSA-9cg5-f7m7-ppvj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "neutrinolabs", "product": "xrdp", "versions": [{"status": "affected", "version": "< 0.10.6.1"}]}], "references": [{"url": "https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-9cg5-f7m7-ppvj", "name": "https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-9cg5-f7m7-ppvj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1", "name": "https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulnerability does not affect the default configuration of xrdp. The vulnerability is only exploitable when the security layer is set to security_layer=negotiate or security_layer=rdp, and the crypto level is changed to crypt_level=fips in xrdp.ini. In this specific non-default mode, the server fails to validate the FIPS padding length field, leading to a pointer underflow and a subsequent negative length calculation. An unauthenticated remote attacker can exploit this by sending a crafted FIPS-protected PDU, causing a heap out-of-bounds read that results in a process crash and denial of service (DoS). However, since xrdp forks a new process for each connection by default, an out-of-bounds read causing a process crash is unlikely to bring down the entire xrdp service. This issue has been fixed in version 0.10.6.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T16:56:03.216Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44978", "state": "PUBLISHED", "dateUpdated": "2026-07-21T16:04:45.918Z", "dateReserved": "2026-05-08T16:23:33.264Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-20T16:56:03.216Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "xrdp", "vendor": "neutrinolabs", "versions": [{"status": "affected", "version": "< 0.10.6.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:neutrinolabs:xrdp:*:*:*:*:*:*:*:*", "matchCriteriaId": "A994DC5A-6181-45D2-A489-0E409B19A0FE", "versionEndExcluding": "0.10.6.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulnerability within the FIPS-specific receive paths. This vulnerability does not affect the default configuration of xrdp. The vulnerability is only exploitable when the security layer is set to security_layer=negotiate or security_layer=rdp, and the crypto level is changed to crypt_level=fips in xrdp.ini. In this specific non-default mode, the server fails to validate the FIPS padding length field, leading to a pointer underflow and a subsequent negative length calculation. An unauthenticated remote attacker can exploit this by sending a crafted FIPS-protected PDU, causing a heap out-of-bounds read that results in a process crash and denial of service (DoS). However, since xrdp forks a new process for each connection by default, an out-of-bounds read causing a process crash is unlikely to bring down the entire xrdp service. This issue has been fixed in version 0.10.6.1."}, {"lang": "es", "value": "xrdp es un servidor RDP de c\u00f3digo abierto. Las versiones 0.10.6 y anteriores contienen una vulnerabilidad de lectura fuera de l\u00edmites de heap dentro de las rutas de recepci\u00f3n espec\u00edficas de FIPS. Esta vulnerabilidad no afecta la configuraci\u00f3n predeterminada de xrdp. La vulnerabilidad solo es explotable cuando la capa de seguridad se establece en security_layer=negotiate o security_layer=rdp, y el nivel criptogr\u00e1fico se cambia a crypt_level=fips en xrdp.ini. En este modo espec\u00edfico no predeterminado, el servidor no valida el campo de longitud de relleno FIPS, lo que lleva a un desbordamiento inferior de puntero y un c\u00e1lculo de longitud negativo subsiguiente. Un atacante remoto no autenticado puede explotar esto enviando una PDU protegida por FIPS manipulada, causando una lectura fuera de l\u00edmites de heap que resulta en un fallo del proceso y denegaci\u00f3n de servicio (DoS). Sin embargo, dado que xrdp bifurca un nuevo proceso para cada conexi\u00f3n por defecto, una lectura fuera de l\u00edmites que causa un fallo del proceso es poco probable que derribe todo el servicio xrdp. Este problema ha sido solucionado en la versi\u00f3n 0.10.6.1."}], "id": "CVE-2026-44978", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44978", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-21T16:03:54.447257Z", "version": "2.0.3"}}]}, "published": "2026-07-20T17:17:09.370", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-9cg5-f7m7-ppvj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-125"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.10.6.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "xrdp", "source": "cna", "vendor": "neutrinolabs"}, "product": "xrdp", "vendor": "neutrinolabs"}], "created": "2026-07-20T23:45:04.950689+00:00", "updated": "2026-07-30T19:00:09.769926+00:00", "vendors": ["neutrinolabs", "neutrinolabs$PRODUCT$xrdp"]}