CVE-2026-32624: 
xrdp vulnerability analysis and mitigation

CVE-2026-32624 is a heap-based buffer overflow vulnerability in xrdp, an open-source RDP server, affecting all versions through 0.10.5. The flaw exists in xrdp's logon processing and is only exploitable when the domain_user_separator directive is explicitly configured in xrdp.ini — a non-default setting. An unauthenticated remote attacker can send a crafted, excessively long username and domain name combination to overflow the internal buffer, potentially causing a Denial of Service (DoS) or unexpected behavior. The vulnerability was disclosed on April 17, 2026, and fixed in xrdp version 0.10.6. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow) and CWE-120 (Buffer Copy without Checking Size of Input), where xrdp fails to validate the length of the combined username and domain name string during logon processing (GitHub Advisory). When domain_user_separator is configured in xrdp.ini, the server parses the incoming credential string by splitting on the separator character, but does not enforce size limits on the resulting components before copying them into a fixed-size heap buffer. An attacker exploits this by sending an RDP logon request with an excessively long username/domain string over the network (TCP port 3389), requiring no authentication or user interaction. The attack requires the non-default domain_user_separator configuration to be present, which serves as the key precondition for exploitation (Red Hat Bugzilla).

Successful exploitation can corrupt adjacent heap memory regions, leading to a Denial of Service through service crashes or unpredictable system behavior. The CVSS scoring reflects a limited integrity impact (unauthorized memory modification) and low availability impact (potential service disruption), with no confidentiality impact identified — data exfiltration is not a primary concern (GitHub Advisory). The scope is limited to the xrdp service itself; lateral movement or broader system compromise is not directly implied by this vulnerability, though memory corruption could theoretically be leveraged for more advanced exploitation in specific scenarios (Red Hat).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.0017 (0.17%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires the non-default domain_user_separator configuration, which significantly limits the exposed attack surface. The vulnerability was reported by researchers credited as exploitintel, smittix, and hessandrew (xrdp v0.10.6 Release).

1. Reconnaissance: Identify internet-facing or network-accessible hosts running xrdp (default port TCP 3389) using tools like Shodan, Censys, or Nmap (nmap -p 3389 --open <target_range>).
2. Verify configuration: Determine whether the target xrdp instance has domain_user_separator configured in /etc/xrdp/xrdp.ini. This may be inferred by testing logon behavior with domain-formatted credentials (e.g., DOMAIN\username).
3. Craft malicious payload: Construct an RDP logon request containing an excessively long username and domain name string that, when combined with the configured separator, exceeds the internal buffer size allocated during logon processing.
4. Send crafted request: Transmit the malicious RDP logon packet to the target on port 3389 without any prior authentication. Tools such as a custom RDP client or raw socket scripts can be used to send the oversized credential fields.
5. Trigger buffer overflow: The xrdp server processes the logon request, copies the oversized string into the heap buffer without bounds checking, overwriting adjacent memory regions and causing a service crash (DoS) or potentially unpredictable behavior (GitHub Advisory, Red Hat Bugzilla).

• Network: Unusual or repeated RDP connection attempts (TCP port 3389) from external or unexpected IP addresses; RDP logon requests containing abnormally long username or domain name fields (hundreds or thousands of characters).
• Logs: xrdp log entries (typically /var/log/xrdp.log or /var/log/xrdp-sesman.log) showing failed logon attempts with malformed or oversized credential strings; repeated connection attempts followed by abrupt disconnections.
• Process: Unexpected crashes or restarts of the xrdp process; core dump files generated in the xrdp working directory following service crashes.
• File System: Presence of core dump files (e.g., core, xrdp.core) in /var/log/xrdp/ or the xrdp installation directory following exploitation attempts.

The primary remediation is to upgrade xrdp to version 0.10.6 or later, which contains the security fix (xrdp v0.10.6 Release). For systems that cannot be immediately upgraded, administrators should verify whether domain_user_separator is configured in /etc/xrdp/xrdp.ini; if it is not needed, comment out or remove this directive to eliminate the attack surface entirely. If the directive is actively required for domain authentication, treat the upgrade as high priority. Additionally, restricting access to port 3389 via firewall rules to only trusted IP ranges reduces exposure to unauthenticated remote attackers (GitHub Advisory, Red Hat).

The xrdp maintainer (metalefty) published the security advisory and patched release on April 17, 2026, crediting researchers exploitintel, smittix, and hessandrew for responsible disclosure (xrdp v0.10.6 Release). Red Hat tracked the issue via Bugzilla and assessed it as medium severity for their product lines (Red Hat Bugzilla). Downstream distributions including FreeBSD (via FreshPorts and VuXML) and openSUSE issued their own security updates incorporating the fix. Coverage has been limited to standard vulnerability aggregation sites and Linux distribution security channels, with no significant broader media attention given the non-default configuration requirement.